I definitely know that there will be more options via BES 5.0 based on the tech seminar yesterday. From
this doc, it states that BES 4.1 SP5 allowed you to do it without the user knowing the previous password. But I know I've been able to do it as well with some of my users and we just upgrade to 4.1 SP6 2 weeks ago.