How can VPN users change domain password

Our remote users access the company network using Cisco Concentrator/Cisco VPN client. To connect to the network they have to establish a VPN tunnel and authenticate with their Domain user name an password. They do not log on to the Domain.
How can remote users change their domain password?

We would like to tighten our password expiration policy, but if their pwd is expired the users will not be able to establish a tunnel.

Clients use WinXP, the domain is a Win 2003 environment.
Thanks so much in advance.