Reduce changes

Reduce the number of forced changes. When forced changes must occur, give users plenty of warning so they have time to come up with another good password [Adams and Sasse, 1999]. (The standard Windows log-on does give warning and it doesn't seem to help much, but it's better than no warning.)