The grace period is optional, I believe.

You might consider a logon trigger to log the last date of logon, and a scheduled job to lock accounts that haven't been used for two months. Maybe there's a more graceful way but I can't think of it.