Just a quick one. Most of my users are using Windows auth but I have a few forms auth users for testing. The passwords on these accounts seemed to expire very quickly and I didn't see any options for changing this. Turns out there is a 'hidden' set of settings available only when you log in as 'super user'. This is the account you installed Portfolio server under.
Login in as that account and you will see the following under settings.
Under this you will have a setting for password expiration. This defaults to 1!
This can be reset to whatever value you require. Note the grace period as well. This defaults to 7. If the password is expired for more than 7 days, the account is locked. Before this, once authenticated, the user will be prompted to change password.