Hello, I was currently working on changing authentication related setup on one NetScaler 13.0. Part of the requirement was to use RADIUS with Microsoft NPS servers. On NetScaler level it has been set up with virtual IP, which is assigned to a couple of load balanced and monitored NPS servers. The RADIUS is configured with MSCHAP v2. A newer requirement is users to be able to change their passwords when they're reset by service desk team and with selected option "User must change password on next logon". According to https://support.citrix.com/article/CTX209044, changing of expired passwords is a supported scenario and it should be working (but it doesn't). NPS servers and NetScaler are configured as per the article. RADIUS is a primary and only method of authentication. I'm wondering what could be the reason for this to be not working and I'm having a couple of questions: 1. Article is mentioning only expired passwords. Are expired passwords, and "User must change password on next logon" treated the same way? 2. Is there anything else, which needs to be configured from Citrix point of view, for example on StoreFront? Unfortunately I have access only to the NetScaler and hadn't been able to check any other part of the Citrix setup. Appreciate any help on the topic.