Question about changing NT global account policy

Hi Folks - If I make a global NT domain change - like minimum password
length, what happens immediately to the users who fall out of compliance -
are they locked out, do they get prompted to change their passwords to meet
the new standards immediately, or will they continue to work correctly out
of compliance until the next time they're prompted to change their password

thanks.