How to change an OD policy for existing accounts

Question

OS X server 10.4
I set up Open Directory with one of the policies being specification to reset password upon first login.
I then imported a batch of accounts from a unix /etc/passwd file with the standard settings header.
I changed my mind about the reset password policy and made the change in Server Admin.
I also am changing password type from crypt to open directory in the Work Group Manager (WGM) for each user. Upon each change, a new password is prompted for and set.
I now find that accounts created via the import process and had password type changed in WGM, along witha a new password setting, cannot get authorization services, for example ssh login or mail, unless the user logs in at an OS X login screen where they are prompted for a new password as required by the policy when their account was created but after the policy is changed in Server Admin.
1. Are OD Server Admin policy changes only applied to accounts made after a policy change save?
2. How do I change the OD policy for a single account, or perhaps a collection of accounts?
-Thanks

Answer 1

Policies can be set for all users at a site in Server Admin, or they can be set for users in Workgroup Manager. In WGM, the options are in the Advanced tab. Policies set on a specific user generally override those set in Server Admin. When policies are set, they become active for all existing and new users. The option, "password must be reset on first user login" is the exception. It dictates how accounts are created. Once an account is flagged for a password change, it must be unset in WGM. Go to the Advanced tab for the user and click the Options button.