Allow enforcing password change for a user after reset by admin (root/domain)

Allow enforcing password change for a user after reset by admin (root/domain) #15900