Is there an example of setting an Active Directory attribute from F5 iRule or Access Policy?

You may be able to play with the logon page and some customization to set variables to trigger the password change, for example if you set so values in logon.inc :

$challenge = 1;

$errorcode = 5023;

$GLOBALS["set_new_password"] = 1;

this is triggering automatically the password change, but i won't recommand it as it is intrusive, and may interfere with APM logon page post processing.

11.5 password change feature allows you to setup a check box in the logon page or before in the vpe with a variable assign (session.logon.last.change_password 1) to allows user to change their password.

But your use case would be more to allow all user to change their password (without the first logon prompt) as they currently don't know it ? is that correct ?