diff --git a/servers/slapd/overlays/ppolicy.c b/servers/slapd/overlays/ppolicy.c
index d3a7b612e1570928ec29525d7a0b074aa2896276..d3c3782216839c007991bd4d541f223e14c3b509 100644
--- a/servers/slapd/overlays/ppolicy.c
+++ b/servers/slapd/overlays/ppolicy.c
@@ -1319,7 +1319,7 @@ locked:
 		}
 		ctrl = create_passcontrol( op, warn, ngut, ppb->pErr );
 	} else if ( pi->send_netscape_controls ) {
-		if ( ppb->pErr != PP_noError || ngut > 0 ) {
+		if ( ppb->pErr != PP_noError || pwExpired ) {
 			ctrl = create_passexpiry( op, 1, 0 );
 		} else if ( warn > 0 ) {
 			ctrl = create_passexpiry( op, 0, warn );