Windows "User must change password at next logon" with kiosks?

Is there a way to allow users to change their passwords from a web page in Windows?

We have a client that has hundreds of 'kiosk' workstations because all the users use web services that have their own logins. All the machines are domain-joined and they sign in to one account automatically.

One of the 'web apps' users sign in to relies on each individual having an account in active directory. When a user forgets their AD password, we would like to reset it to a default password that everyone in the company knows, and we tell the user to go reset it.

On a 'normal' windows network, they would hit CTRL+ALT+DEL, put in their username and the default password, and then be prompted to change it.

...but on a kiosk network, they are already signed in to the generic account, and the web app has no way of forcing the password change. So they still can't sign in. We also can't enforce policies of expiring passwords every $x months.

I know Outlook Web Access has a form built-in for allowing users to change passwords. Unfortunately, this client doesn't use Outlook Web Access.

Is there a 3rd party utility or a better way of allowing users to change their passwords? Even a desktop app we can tell them to run to enter a username, default password, new password, and a confirmation would be useful.