Active Directory: Change a User Password

Before You Change the Password

Use these steps only if you are authorized to administer the account. You need an account with permission to reset passwords for the user’s organizational unit or an equivalent delegated scope. Being able to view the account does not necessarily mean you can reset its password.

Confirm the user’s identity and locate the exact directory account. Check the user principal name, sign-in name, organizational unit, and other approved identifiers. Display names may be duplicated, so do not select an account by name alone.

Verify which environment controls the password. The account might be stored only in an on-premises Active Directory domain, synchronized to a cloud identity service, or managed entirely outside Active Directory. Also determine whether it is a regular user, privileged administrator, service, shared, or managed account. Service and privileged accounts may require a separate approved process because changing their credentials can affect applications, scheduled tasks, or services.

Change a User Password in Active Directory Users and Computers

Active Directory Users and Computers provides the standard graphical method for an authorized administrator to reset a domain user’s password.

1. Open Active Directory Users and Computers from an authorized administrative workstation or management server.
2. If you need to identify the account by additional attributes, select View and enable Advanced Features.
3. Browse to the organizational unit containing the account, or use the console’s Find action to search for it.
4. Confirm that the result is the intended user. Check the account name and directory location before continuing.
5. Right-click the user and select Reset Password.
6. Enter the new password in both password fields.
7. Select or clear the available password options according to your organization’s policy and the user’s situation.
8. Select OK, then review the confirmation shown by the console.

This is an administrative reset, not a normal password change performed by the user. An administrator does not need the old password, but must have the delegated Reset Password permission for that account.

Change the Password with PowerShell

PowerShell is useful when you have the ActiveDirectory module installed and are working in an authorized session that can contact the appropriate domain. The administrative account still needs permission to reset the target user’s password.

First, identify the user with Get-ADUser and verify a unique attribute such as the user principal name, distinguished name, object GUID, or confirmed SAM account name. Avoid relying only on a display name.

To keep the new password out of command history and visible text, collect it as a secure string:

$NewPassword = Read-Host "Enter new password" -AsSecureString

Then perform the reset for the verified identity:

Set-ADAccountPassword -Identity "confirmed-account-name" -Reset -NewPassword $NewPassword

If policy requires the user to replace the temporary password at the next interactive sign-in, set that account property separately:

Set-ADUser -Identity "confirmed-account-name" -ChangePasswordAtLogon $true

Do not place a real password directly in a script, command line, transcript, ticket, or chat message. For repeatable administration, use your organization’s approved secret-handling and auditing process.

Choose the Correct Password Options

Select User must change password at next logon when the administrator is issuing a temporary password and the user can complete an interactive sign-in. The initial sign-in should prompt the user to choose a private replacement. This option may be unsuitable for service accounts or workflows that cannot handle an interactive password-change prompt.

Select Unlock the user’s account only when the account is actually locked and you are authorized to unlock it. A reset and an unlock are related but separate actions. Resetting the password does not always remove the lockout state.

Password never expires is an account control, not a shortcut around password policy. Use it only where an approved policy requires it. It can conflict with User must change password at next logon, and some account types are managed through different password-rotation controls.

The domain’s password and fine-grained password policies can enforce length, complexity, history, minimum age, and other rules. Available check boxes do not override those policies. The policy applied to this user determines whether the proposed password is accepted.

If the Password Change Fails

• Insufficient permissions: confirm that your administrative identity has Reset Password permission for this specific user and organizational unit. Protected or privileged accounts may follow different delegation rules.

• Domain-controller connectivity: verify that the workstation can reach the correct domain and that required directory services are available. Confirm that you are administering the intended domain.

• Password-policy violation: choose a password that meets the applicable domain or fine-grained policy and does not violate password history. Do not try to bypass the policy.

• Replication delay: a successful reset handled by one domain controller may not yet be known to another. Check which domain controller processed the change and follow your organization’s replication troubleshooting procedure.

• Locked or disabled account: unlock the account separately if appropriate. A disabled account must be reviewed and enabled through an authorized process; a password reset alone does not enable it.

• Hybrid identity: determine whether passwords are written from Active Directory to the cloud, from the cloud to Active Directory, or managed by another authority. Check synchronization health and use the reset method approved for the authoritative source.

Confirm the New Password Works

First confirm that the administrative tool reported success and recheck the intended account’s identity. Do not ask the user to send the new password back to you. Deliver temporary credentials through the organization’s approved secure channel.

Have the user start a fresh sign-in to a domain-connected device or approved service. If User must change password at next logon was selected, the temporary password should lead to a prompt for a new private password. The replacement must satisfy the applicable policy.

Existing sessions may remain open because a password reset does not automatically prove that every session has ended. Cached credentials, stored passwords, mobile mail clients, mapped resources, scheduled tasks, and remote sessions may continue using the old credential or repeatedly trigger lockouts. The user should update saved credentials where authorized, close unneeded sessions, and follow the organization’s sign-out or session-revocation process if compromise is suspected.

After access is restored, the user should keep the password private, update only approved password managers or applications, and report unexpected prompts or repeated lockouts to the directory support team.