I'm a bit confused with your statement "when ~120 days approach". Are their accounts locked prior to the 120 days?
From what I've seen, an account will not be disabled, but will require a change of password, as you expect as well. However I must admit it's been a while since I've set this up since using Enterprise authentication is not the best solution.
Do some testing with 2 days limit and see what happens.
Cheers,
Josh