Passwords expire without forcing change

I have a situation over a 3000 user infrastructure running W2K Active Directory. Forced password changing is set at 90 days. The users receive a 10 day away reminder, but that is it. Once the 10 days expire, they can log on to the network, but get achange password box when opening Outlook or network shares. Why isn’t it forcing them to change their password when they attempt to log in after the 10 day period? This is really messing with my remote users.