@WLS-ITGuy said in GPO question:
@JasGot said in GPO question:
net accounts /domain

Which is interesting to know but I guess helps me figure out why they can't change their passwords.
And there you have it! Your GPO is preventing the exchange server from allowing the password to be changed any more often than 30 days. Come back in a month and it'll work. 
So, I would leave the complexity in place, and set the Min Age to zero days. (All in the GPO on the DC)
Also, since my clients always put off changing their password until they can't..... I would implement this on your CAS/OWA server so they can change their passwords even after it has expired.
On the Client Access Server (CAS), click Start > Run and type regedit.exe and click OK.
Navigate to HKLM\SYSTEM\CurrentControlSet\Services\MSExchange OWA.
Right click the MSExchange OWA key and click New > DWord (32-bit).
The DWORD value name is ChangeExpiredPasswordEnabled and set the value to 1.
Note: The values accepted are 1 (or any non-zero value) for "Enabled" or 0 or blank / not present for "Disabled"
After you configure this DWORD value, you must reset IIS. The recommended method to reset IIS is to use IISReset /noforce from a command prompt.
Ref: http://blogs.technet.com/b/exchange/archive/2010/10/06/3411240.aspx