It depends on what the authenticating from, and what type of Radius server you're talking about. The trouble with password expiry is that it requires MsCHAPv2 support to be able to change it, not many Radius servers or NAS's support that.
If they're connecting to a VPN3000 concentrator and authenticating to an ACS NT Radius server, then with the new versions of code you can do it. The user will get prompted to change their password when they connect in. If they're connecting to a PIX or router, then they currently don't support any password expiry feature, nor does ACS Unix.
This has been a big problem for a number of users, but unfortauntely at the moment there's not many ways around it.
