Here is what I would do:

1. Create a table called "PreviousUserPasswords" and make some fields - ID, userid, Password DateCreated,

2. Open Admin/Users/Password.ascx.vb and find "Private sub cmdUpdate_Click()" around line 269.

3. put some codes before '1. check new password and confirm are the same''

[Some codes - no actual code, just comments. sorry for me being lazy lol ]

'0. Check the new password against a table PreviousUserPassword.

'execute sql (e.g. where password = txtNewpassword.txt) to check to see if there is any same password the user created before.

'if there is a same password in the table, throw an error message.  If it's not same, update the user password and also add the new password to the PreviousUserPasswords. Overwrite the oldest password if there are 12 passwords or more associated with this particular user.

lol. 12 passwords... I wouldn't be able to login to the site 4ever if i forget my password. Just imagine,,, users keep tying their passwords but nothing works, that would create BIG frustration.  i mean,,, i myself don't have 10 unique passwords. Well, that's what your client asked you to do right? GOOD LUCK!

Another way without modifying the core would be to create your own custom membership provider and override the ChangePassword method, where you can add your custom logic and affect the UserPasswords table each time a password is changed. Then you'd override the ValidateUser method or the UserLogin method to check that the provided password is valid according to your criteria. You can have a quick look in how to implement this here:

http://briansamson.com/b/2006/dotnetnuke-4-custom-authentication-single-sign-on/

Once you have your own dll, make the according changes in the Providers sections of your web.config and you are ready to go. It envolves a bit more effort, but if you need to reverse the changes you'll only be one line away, and you wont have to worry (too much) when you need to upgrade your DNN installation.

Cheers,