Is there an example of setting an Active Directory attribute from F5 iRule or Access Policy?

Yes, but that was the next task on my list, which is now done aside from tidying up the wording and layout and testing ;) I'm not sure if this helps for my current case or not, what I'd ideally like to do is jump into a regular "logon" screen but straight into the password change view, but I can't see how that can fit into the policy (since there seems to be interactions between the "Logon Screen, and the "AD Auth" which aren't documented or explained - it might all be in the PHP but reverse engineering it is hard).