Sharepoint 2010 APM query to AD for Expired, New and compromised Passwords

We have Sharepoint 2010 setup in our lab environment using the iapp. When a new contractor is given a domain account they are given a static password which must be changed at initial login. Can this be done using the APM by setting up a branch off the AD Auth policy? We would also like to give the contractors the option to change their password if they feel it has become compromised or if they are about to expire.