Expire all MD5 administrator accounts: security login expire-password -vserver * -username * -hash-function md5

Ask users of MD5 accounts to log in through a console or SSH session.

Lock accounts that still use the MD5 hash function (advanced privilege level): security login expire-password -vserver * -username * -hash-function md5 -lock-after integer

Unlock the accounts when the users are ready to change their passwords: security login unlock -vserver svm_name -username user_name

Have users log in to their accounts through a console or SSH session and change their passwords when the system prompts them to do so.