Implement new password policy

Question

Long story short, inherited an existing domain that has this below in place for their password policy.  I really need to get them into alignment with us, so I need to change this policy to the second one below.  But I know if just went and changed
those settings, every user(there are only about 30 users) would get prompted to change their password the next time they logged in.  The domain is 2003, so I know that fine grain is not an option.  Is there anything I can do to lessen the blow,
maybe some kind of script that changes the password last set or something like that??  I went and looked at the attribute on a few of these users, they haven't been set in about 8 years.
Enforce password history   0 passwords remembered
Maximum password age   0 days
Minimum password age   0 days
Minimum password length   4 characters
Password must meet complexity requirements   Disabled
Store passwords using reversible encryption   Disabled
Enforce password history   10 passwords remembered
Maximum password age   60 days
Minimum password age    1 days
Minimum password length   8 characters
Password must meet complexity requirements   Enabled
Store passwords using reversible encryption   Disabled

Answer 1

"Lessen the blow" ??
Do you mean for you (the admin who would need to deal with lockouts/resets)?
Or do you mean for the 30 users ?
I'd suggest that you try to implement in as few steps as possible. In my experience, progressively enabling password policy settings can be very confusing for end-users, when done in several phases.
Keep it to two phases, is my advice.
1) enable everything except aging/expiry
2) encourage/warn your users that new criteria are in place (length, strength, etc)
3) encourage your users to manually perform password change. This familiarises them with the length/strength requirements, and, you'll get them doing it at slightly different times, allowing them, and you, to handle the volume of assistance calls.
4) enable aging after a few days or two weeks. This means that users who have opted-in early, will only need to deal with the expiry window in ~60 days, and will have been through it recently, and so will be familiar.
Those users who didn't opt-in early via manual password change, will be hit with a forced-change and all-new length/strength concepts to deal with all at once. And you'll get calls from those people, because the Windows password policy dialogs/messages are
quite awful.
Also, consider the impact of your existing (or proposed) account lockout settings.
If these users are technically-savvy (eg are software developers or whatever), they may have many logon sessions running, many devices with cached accounts, etc - this can cause a spike in your account-lockouts, and users who haven't changed passwords in a
long time, often have many cached/saved/stored/concurrent sessions.
We have around 1000 calls at helpdesk for password resets/unlocks per week in our estate. We do have a self-service password reset service. We still get calls. We introduced similar password policies to you, more than 10 years ago. It still causes hellish
Monday spikes in reset/unlock calls.
sigh.
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)