Passwords must:
Password History: On password reset, either requested or through expiration, users cannot reuse the last 12 passwords.
Password Expiration: Password Expiration is controlled under Server Settings.