I'm not aware of any database product that doesn't use one-way encryption on passwords. Expiration and change of passwords is outside the scope of the ArcSDE API.
The only thing ArcSDE command-line will let you do is delete Windows services that use a password which has been changed or lost.