This is a known issue. Not sure if it ever got fixed in SM 14 or not, but this problem snuck into SM as of v13.3.5535. This was reported back in this thread:

 

Thanks.

 

I can confirm this issue still exists in SM v14 then :-(

Can admins please verify if the "Disable outgoing SMTP when auto-grace period ends" option is also checked when you have "Disable password strength for existing passwords" enabled?  To clarify, if the "Disable outgoing SMTP" option is unchecked, then any new user or change to an existing password would have to meet the password requirements.  All existing passwords would "ignore" the new requirements.  However, if you have "Disable outgoing SMTP when auto-block grace period ends" it essentially overrides the "Disable password strength for existing passwords" option.  The server will check all passwords against the password requirements and notify violating users according to the "User Notification Timing" rule specified.

 

The "Disable outing SMTP" option was devised to alert password-violating users that they need to update their passwords within XX number of days.  This is so admins are not inundated with tickets if password changes want immediately into effect.

 

Are there any scenarios in which admins would want to both of those options enabled simultaneously?

Robert,

 

The only options we do not have (and have not ever) enabled in SECURITY > PASSWORD REQUIREMENTS are "Password Expiration" and "Disable outgoing SMTP when auto-block grace period ends".

 

After the first time that User Notifications were automatically sent out to all existing users who did not meet password requirements (despite having "Disable password strength for existing passwords" checked) which occurred after installing the v13.3.5535 upgrade, we set our User Notification Timing to 365 days in fear of a repeat. It hasn't sent the automated notifications since upgrading to two different v14 versions, but personally won't know for sure if the problem persists until March 2016 when the User Notification Timing variable has passed.

 

(Thankfully you have allowed us to alter the automated User Notifications in v14 so we preemptively updated ours with letterhead, signatures, F.A.Q. links, css and html so it looks legit and less likely to cause customer backlash if it automatically goes out again.)