Now this is a good one. Without trying implement the whole plan, I can imagine something like this. Step one would be to somehow let the users know that they need to change their password. You would have to ensure that users had plenty of notification that their password was going to expire. Assuming that users log in at least once a week and that passwords have to be changed every 4 months, you could write a script that scrubbed the user database for all passwords that are at least 90 days old. The script could then email users with a notification that their accounts are going to expire in 30 days. The email could contain a URL to a web page that allowed them to change their password. I know that IIS supports changing domain passwords using htr files. Microsoft articles Q268419, Q240654 and Q184619 deal with this technology. You could also do it with active server pages. Be careful with the htr files. There are specific security vulnerabilities associated with them. Also, no matter what you choose, protect it with SSL.
Summary.
1. Use a script to email a notification to users.
2. Users see the email and go to the web page
3. Some method (HTR or ASP) used to change password
4. Happy users and admins all around.