trigger domain wide password reset - best practice?

I would like to trigger a once off password reset to all users in our domain. What is the best method to do this?

I thought about creating a new GPO and adding it to groups or maybe a new fine grained policy?