Set up a Chrome action rule to restrict users from defined ChromeOS actions after twenty failed password attempts.

Create an activity rule for user log events, define a time period and threshold, and select an Action for the rule to force a password change.

Create an activity rule for live-state data sources that meets the required time period and threshold to identify users who need to change their password.

Enable email alerts to notify users that they need to change their password.