Domain workstation asked user to change password

[force5]

I realize that this also could go in the XP Pro forum, but I'll try here first. Last week a user went to log onto his workstation and it asked him to change his password. He had a customer come in for business, so he just went ahead and hit ENTER and this in fact let him change it to be blank password. We do not allow passwords to be changed and they never expire. We also do not have a lock out policy if they enter the wrong password multiple times. This is how 100% of the users are set up across the whole domain. I looked at security logs and re-verified his account settings (after resetting his password to something more complex in case it may be an attack) and everything is set fine.
I remember there was a virus a couple of years ago that did this, but our Trend Micro Office Scan is up to date for that virus. I researched online and found nothing...no new virus' or anything. How can this happen? Any help would be appreciated!

Thanks,

Chad

Thanks,

Chad
Network Administrator

 

[GrimR]

Add this to view additional AD info, hopefully you can see if the password was reset etc

http://www.petri.co.il/view_additional_user_information_in_aduc.htm