Remote Desktop Services (formerly known as Terminal Services) can be access through a RD Web Access portal which traditionally did not present a descriptive error message or allow a user to change an expired password. The same issue is also present when an account is set to require password change on next login.
Good news for Server 2012 and 2012 R2, password change functionality is shipped with RD Web access but disabled by default. Enable it with a simple web-app property change in IIS. For users still on 2008 R2 RD Web access, a Hot-Fix is available to provide the same functionality. For details and to enable this useful feature, see the following Microsoft Remote Desktop Services Blog article.