pretty new to AD,,,I have searched the forums and am confused a bit about
synchrozing passwordexpirationtime from edir to AD.

1. there does not appear to be a passwordexpirationtime attribute on the
AD side?

2. If a password expires in AD, is it simply best to populate the
pwdlastset to "0"? If you do this way though, one could theoretically use
AD forever if they never touch the edir side and login with an
expiredpassword.

All the tids talk about going from AD to edir,,,,we disable the password
change in AD so that everything comes from edir,,,but I am still confused
as to how to get say a 90 day expiration pushed from edir to AD. thanks!