We have noticed a problem with users logging in when their password expires.

The expired password box appears and prompts the user to use a new password, we require users to have 8 characters or more with 2 being numbers.

If a user was to enter a new password which didn't meet these requirements (lord knows why - students) they would be prompted that the password was illegal, but would still be logged in normally with their old password unchanged, and be prompted again later.

Is this a generally issue? Or purposely put in? Would like to see if there is a fix if possible.