We have not yet been able to determine what might cause this. If you have the source, can you add the {$D+} directive to the Oracle.inc file, add the source directory to the Delphi search path, and trace the issue? You should be able to see how the expiration is detected, which function is called to set the expired password, and how the ORA-001017 exception is eventually raised.