How to Change a Password in Active Directory

Before You Change the Password

First decide whether you are changing a known password or resetting a forgotten one. A change proves the user knows the current password. A reset replaces it through an authorized administrator without requiring the old password. This change password vs reset password Active Directory distinction affects permissions, auditing, and access to protected user data.

To change your own password, sign in with the domain account, know the current password, and connect the computer to a domain controller through the workplace network or approved remote connection. To reset another user’s password, you need delegated reset permission or an appropriately authorized administrative account. Being a local administrator on one computer does not automatically grant that domain permission.

Choose a password that meets the domain’s length, complexity, history, and minimum-age rules. A recently used password may be rejected. In a hybrid environment, determine whether the account is managed by on-premises Active Directory or by Microsoft Entra ID. Cloud-only password procedures are different and are outside this guide.

Change Your Own Active Directory Password

For most people asking how to change password in Active Directory, the standard Windows security screen is the safest method. Use a computer signed in to the domain and connected to a domain controller.

1. Press Ctrl+Alt+Delete.
2. Select Change a password.
3. If an account name is shown, confirm that it is the correct domain account.
4. Enter the current password in the old-password field.
5. Enter the new password, then enter it again in the confirmation field.
6. Submit the change and wait for Windows to confirm that the password was changed.

This is the normal way to change a password in Active Directory when you know the existing password. Locking and unlocking the computer afterward can confirm the new password without ending all current work. Update approved password managers or stored workplace credentials as required by your organization.

Change a User Password as an Administrator

An authorized administrator can change password on Active Directory accounts by resetting them in Active Directory Users and Computers. This method is appropriate when the user forgot the password or an administrative reset is required.

1. Open Active Directory Users and Computers from an authorized administrative workstation.
2. Find the correct domain, organizational unit, and user account.
3. Verify the user’s identity and confirm that the selected account is correct.
4. Open the account’s context menu and select Reset Password.
5. Enter and confirm the temporary or replacement password.
6. Select User must change password at next logon when policy requires the user to choose a private password at the next interactive sign-in.
7. Complete the reset and give the password to the user through the organization’s approved secure process.

Do not use the next-sign-in option for accounts that cannot complete an interactive sign-in, such as many service accounts. A reset can also affect access to data protected with keys derived from the old password, so follow organizational procedures before resetting an account.

Change the Password with PowerShell

Administrators can use the Active Directory PowerShell module when graphical tools are unavailable or a controlled workflow requires commands. Do not type real passwords directly into a command, save them in a script, or place them in command history.

For a known-password change, collect both the old and new passwords interactively as SecureString values, then use Set-ADAccountPassword with the account identity, the OldPassword value, and the NewPassword value. The operation runs as a password change and still depends on the user’s rights, domain connectivity, and password policy.

For an administrator reset, collect the new password interactively as a SecureString and use Set-ADAccountPassword with the account identity, the Reset switch, and the NewPassword value. The administrator must have reset permission. If the user must replace that password at sign-in, an authorized administrator can separately set the account’s change-password-at-logon state. Review the target identity before running either operation.

This separation matters when deciding how to change Active Directory password values: a known-password change and an administrative reset are not interchangeable.

Change a Service Account Password Safely

Before you change service account password Active Directory credentials, identify every system that uses the account. Traditional service accounts may run Windows services, scheduled tasks, application pools, database connections, monitoring tools, backup jobs, scripts, or applications with stored credentials.

• Confirm the account owner and obtain approval for the maintenance window.
• Inventory dependent systems on every server, not only the first system found.
• Plan the order for changing the domain password and updating each dependency.
• Keep an authorized recovery plan in case a critical service fails.
• Update stored credentials securely, then restart or recycle affected components as required.
• Test sign-in, service health, scheduled execution, and downstream connections.

Do not enable User must change password at next logon for a noninteractive service account. Managed service accounts and group managed service accounts are different: Windows and Active Directory manage their passwords automatically. Do not manually rotate one as though it were a traditional user-based service account; follow the organization’s managed-account process.

If the New Password Does Not Work

If Windows rejects the new value immediately, check the domain password policy. The password may be too short, lack required complexity, match password history, or be blocked by minimum password age. Do not try to bypass these controls.

An access-denied result usually means the operator lacks permission, the wrong account was selected, or a protected account has stricter delegation. Use an authorized account or ask the domain administrator to perform the reset.

If no domain controller is available, reconnect to the workplace network or approved remote connection and try again. After a successful change, replication between domain controllers can cause a short mismatch across locations. Confirm which domain the account belongs to and allow normal replication rather than repeatedly resetting the password.

A disconnected computer may accept cached credentials from an earlier sign-in even though network services require the new password. Connect to the domain and sign in with the new password. If the account is locked, an authorized administrator must address the lockout according to policy.

Finally, check applications, services, scheduled tasks, mapped resources, mobile clients, and stored credentials that may still submit the old password. Repeated attempts from one of these sources can lock the account again. Update each approved credential store instead of changing the password repeatedly.