I have implemented a password policy where my users have to change passwords every so often. However, all of them receive the message that they don't have permissions to change it, and are then denied access to the domain.
There is no "change password" permission under Advanced user rights in User Manager for domains.
Help!

Here is a portion of Technet article

(Q125575)

When you attempt to change your expired domain password from a client workstation, the Access Denied error message appears. This problem occurs when "Users Must Log On In Order To Change Password" is selected in the User Manager for Domains Account Policy dialog box.
The default Windows NT Server configuration does not have "User Must Log On In Order To Change Password" selected. A system administrator must modify the user account for the person receiving the Access Denied error message by either assigning a new password or clearing the "User must log on in order to change password" check box.

That's it! Thanx