APM V11.1HF1 querying Active Directory

It should definitely work and user should be prompted to change their password. What exactly are you seeing? Can you try with a plain vanilla non-customized access policy - just logon page, then AD AUth to the domain that has user expired, then allow? That is a good way to find out where and how exactly we should approach troubleshooting this situation further - i.e. if the problem is due to the configuration of the VPE or somewhere below...