We are about to implement a new password policy that will require users to change their password every six months. We also need every user to change their password *this* week. I'd rather not create a biannual password-change-frenzy, and would prefer to either randomize or stagger the password expiration date.

I receive an error when attempting to modify the pwdLastSet property in ADSI edit. It seems the property may be read-only. If I can write to it, I'm not sure if modifying the pwdLastSet property directly will have any ill effects. 

I considered implementing multiple password policies, but from what I read, multiple password policies are not supported at DFL 2003, which would require an upgrade (though it may make for a half-decent excuse to finally upgrade.)

How can I avoid a week long company wide password change that occurs every six months when all users require a password change immediately?