Hello team,
what maybe reason - I mean configuration , for behavior end user does not has access when password expired .. the user did not pay attention on popup in system tray.. only after machine restart gets notification to change password on windows login..
on ISE "enable change password" enabled and also on allowed protocols..

endpoint configuration:
Authentication mode - user or computer authentication
authentication :
method Microsoft PEAP
remember my credentials for this connection each time i'm logged on - UNCHECKED
fallback to unauthorized network access - UNCHECKED

thanks in advance
Michael

Depending on is rules condition is available, you might be able to allow limited AD access when this happens so user can only change password, otherwise, user may need to change password using other OOB method.