An system administrator can choose expire passwords for all users any time they want to enforce extra security for their organization.
Navigate to Setup | Administration | Security Controls | Expire All Passwords
Select Expire all user passwords and then click Save to expire the passwords for all of the users in your organization. The next time the users log in, they will be asked to set their passwords to a new value.
After you expire passwords, users might need to activate their computers to successfully login to Salesforce. See Activating Your Computer
For more options you can set to ensure password security, see Force.com's Set Password Policies.