This is not possible to accomplish, as Active Directory does not properly handle forced password changes through the LDAP protocol. When the password is expired, it disallows LDAP binds by that user, rather than providing a grace period to change the password. As a result, it's impossible to bind for password-change.

Active Directory's forced password change only works properly with Kerberos. Please advise customers that they need to either switch to using Kerberos for authentication or petition Microsoft to have Active Directory provide a password-change grace period.