The password change is mandatory.. or not?

Hi All,

I set the
"Site Administration / Plugins / Authentication / Manage Authentication / Manual accounts - settings"  

(enable passwords  expiry: yes) within 30 days of a password having to change
(password duration: 30 days) .

After 30 days the system has been reporting for the user :"Your password is expired. Do you want change your password now?"

My problem is the students can select the "cancel" option after the 30 days.  
(They are reach the portal without password modification after 30days.)

I am sure it is a setting problem, but I dont know where I can find it.

Thank you for your help.

Regards
Somogyi J.

(Sorry my english)