Cisco AAA/Identity/Nac :: ACS 5.1 With Outlook Web Access

I have an AD User, lets call them workauser and there password just expired, so next logon to the domain they need to change there password.They decide while at home to connect to Outlook Web Access, which authenticates to via ACS 5.1 to AD, when they try and connect they are denied with the following message in ACS -
 
24407 User authentication against Active Directory failed since user is required to change his password Authentication failed.
 
Check the password expiry under Account options in the properties of an  external database user. If the password is expired and the Enable Change  Password is turned on in the Users and Identity Stores: External  Identity Stores > Active Directory page, then the password will be  changed.
 
Now, our OWA is not configured to allow password resets, so they must call in to have there password reset, or they can connect via VPN and our ASA allows them to change there password as configured under Identity Stores > Active Directory > Enable Password Change
 
This VPN password change is successful although OWA still will not work. The only way to fix it is to select passwsord does not expire within AD. Let it replicate, then de-select password does not expire and let it replicate.
 
This is pointing to a OWA issue in my opinion, although ACS is somehow involved, is it possible that ACS caches authentication, or because OWA does not allow password resets, it keeps responding with user required to change his password?