Password communication

[pepsdiaz () gmail com]

Dear all,
 
We are trying to implement a password policy in our Organization and we have some doubts when distributing the password 
to all the employees. I would like to know which is the best way to communicate the new password when the user 
block/forgot his password. 
 
1) We don´t want to use an envelope because it takes long time.
 
2) Telephone is insecure, how to authenticate the user?
 
3) email is also insecure...
 
4) PKI... expensive?
 
Thanks to all in advance.