So what we ended up deciding to do, thanks to all the fine suggestions here, is to enable the new policies for passwords for both admins and users in their respective OUs and we are just going to let user passwords expire naturally and over the next 12 months, everyone will be moved to the new password requirements. Obviously all new hires will have it from the start. Thanks to everyone for your help in this! I really appreciate it!