windows users changing passwords on os x server

Most of the clients I serve off of my OS X server (currently 10.2.8, shortly going to 10.3) connect from MacOS X. However, I have a handful of Windows clients (running either Win2K or WinXP) who connect. I assign them a default password, but I have yet to figure out how they can change it themselves. Many of these users are in Windows-only offices, and do not have access to a Mac (my former suggested solution). Is there a solution so that these Windows users can change their own passwords without a Mac, without my intervention, and without a login shell? (I leave the latter disabled due to security concerns). thanks!