AD__Force a Group to Change Password

# Replace OU_NAME with the OU you want to apply

Get-ADuser -Filter {memberof -RecursiveMatch "OU_NAME"} | Set-ADuser -CannotChangePassword:$false -PasswordNeverExpires:$false -ChangePasswordAtLogon:$false