The way I usually do it is log one client in manually once a week when the authenticator prompt comes up. Then I log him back out to login screen. Then I broadcast password to everyone and they all just login as usual without the authenticator prompt for another week or so.