AD Password prompt changes / branching

Hi all I have the APM / AD password change successfully working. I have

login page > AD Auth > AD Query > Allow

. Pretty generic. My question is can the process be interrupted and branched. If a users password is expired or expiring and they are a member of AD group , show a messagebox (or disallow changing password) before displaying the password change form from F5. Some staff here have a recommendation to change password on their local systems and we want to warn them. I have tried branching with

mcget {session.ad.last.errmsg}] contains "password expires"

in my AD Query but I have not been able to make it work.

Another similar area I am trying to work on, where the length of required password and the fact that the password must meet complexity requirements are displayed from the policy on the user. They are great but I would like to describe the complexity better. Either modifying that dialogue or via messagebox?

Charlie