The last pwd change value is stored in AD. The problem I see is that the value would only be reliable on the DC the user was authenticated against and it takes time to replicate across the DCs. Not sure if it is also stored immediately on the PDC emulator.
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
