I totally agree that password expiry is a problem, however I have twice taken over AD based systems where there was widespread password sharing, and I found IT

I totally agree that password expiry is a problem, however I have twice taken over AD based systems where there was widespread password sharing, and I found IT knew a lot of passwords of users. I found that a one off change didn't help, they all just updated each other. So my advice is to advise people that they will get resets. To run them through a couple with increasing complexity requirements. Then increase the period between resets dramatically without telling anyone, so 30 days (Still a novelty), 90 days (less fun), 120 days, 360 days. I suppose it is a password re-education exercise really. I always remind people that they are welcome to change their password whenever they want (then they will never see a forced reset). I also tell them that my single biggest requirement is that they don't use their Facebook password for work! I will keep password resets, but nothing like the 90 days PCI DSS still insists on. In legacy systems shared admin credentials are very common, and while working towards individual logins I tend to rotate these often, since a password manager can be used. It is hard to have individual accounts for everyone at an external support company for instance....