Change an Active Directory User Password

Before Changing the User Password

Before you change a password for an Active Directory user, sign in with an administrative account that has been authorized to reset passwords for that user. Access may be delegated for a specific organizational unit, so do not assume that general access to Active Directory also includes password-reset rights. Use only the permissions assigned by your organization.

Confirm the user’s identity and locate the correct account before making any change. Check the sign-in name, display name, domain, organizational unit, and any other approved identifier available in your directory. This is especially important when people have similar names, multiple accounts, or accounts in more than one domain.

Review the password policy that applies to the account. The effective policy may come from the domain or a fine-grained password policy. It can control length, complexity, password history, and minimum password age. Do not weaken or bypass the policy to make a proposed password work.

Change the Password in Active Directory Users and Computers

Active Directory Users and Computers provides the standard graphical procedure for an administrative password reset. Run the console from a managed computer that can contact the appropriate domain and on which the required administration tools are installed.

1. Open Active Directory Users and Computers.
2. If necessary, select the correct domain in the console tree. Use the Find command or browse to the organizational unit containing the account.
3. Check the account details carefully to make sure you selected the intended user.
4. Right-click the user and select Reset Password.
5. Enter the new password, then enter it again for confirmation.
6. Select User must change password at next logon when the user should replace the temporary password after signing in.
7. If the reset dialog offers an option to unlock the account, select it only when the account is actually locked and your organization’s process permits unlocking it.
8. Confirm the reset and read the result shown by the console.

A reset performed by an administrator does not require the user’s current password. It is different from a user changing a password while already signed in. Applications, scheduled tasks, services, or stored credentials that use the old password may need separate attention under your organization’s procedures.

Change the Password with PowerShell

PowerShell is useful when you need a supported command-line method. The computer needs the ActiveDirectory module, and your administrative account must have authority over the target account. Import the module if it is not already available, then identify the user with an unambiguous value such as the account’s distinguished name or verified sign-in name.

For an administrative reset, first collect the new password as a SecureString with Read-Host and the AsSecureString option. Then pass that secure value to Set-ADAccountPassword with the user identity, the Reset switch, and the NewPassword parameter. Avoid putting a plain-text password directly in a script, command history, transcript, log, or reusable variable.

If the user knows the current password and is performing an ordinary change, Set-ADAccountPassword supports OldPassword and NewPassword secure values without the Reset switch. This proves knowledge of the existing password. An administrative reset uses Reset and does not supply the old password. Choose the operation that matches the situation rather than treating the two as interchangeable.

After a reset, Set-ADUser can set ChangePasswordAtLogon to true when appropriate. Check command errors before telling the user that the change succeeded.

Require a Password Change at Next Sign-In

Use User must change password at next logon when an administrator has assigned a temporary password and the user should create a private replacement. This limits how long the administrator-created credential remains usable and keeps the user’s final password unknown to support staff.

Explain the effect before the user signs in. The temporary password gets the user to the password-change prompt, but the sign-in process is not complete until the user enters an acceptable new password. The user may need a connection to the organization’s domain environment for that prompt to reach a domain controller.

Do not enable this option blindly for accounts used by services, scheduled tasks, or other noninteractive processes. Those accounts may be unable to respond to an interactive password-change prompt. Follow the organization’s account-management policy for those cases.

Troubleshoot Password Change Errors

• Insufficient permissions: Confirm that the administrator has delegated reset rights for the user’s location in the directory. Try neither privilege escalation nor a policy bypass; send the request through the authorized administrative path.

• Password-policy failure: Choose a password that meets the effective length, complexity, history, and age rules. The error may not identify every failed rule, especially when a fine-grained policy applies.

• Locked or disabled account: A password reset does not necessarily enable a disabled account. Check account status separately. Unlock the account only after following the applicable security process.

• Domain-controller connectivity: Confirm that the administration computer can reach the correct domain and that name resolution and the secure network connection are working. A local or disconnected computer cannot complete a domain reset reliably.

• Replication delay: A reset handled by one domain controller may not yet be visible to every domain controller. Check which controller processed the request and investigate directory replication rather than repeatedly assigning new passwords.

• Cached credentials: A disconnected Windows computer may still evaluate an earlier cached sign-in. Connect it through the organization’s approved method so it can validate the new domain password. Remember that saved credentials in apps and devices may continue trying the old password and cause another lockout.

Confirm the New Password Works

Confirm that the reset command or console reported success, then verify the account’s enabled and lockout state separately. When practical, have the user test the new credential through an approved domain-connected sign-in while support remains available. Do not ask the user to read the password back or send it for confirmation.

Give a temporary password only through the organization’s approved secure channel after verifying the recipient. Keep it out of tickets, ordinary messages, screen captures, and logs. If User must change password at next logon is enabled, tell the user to enter the temporary password once and then create a new password that meets policy.

Record only that the Active Directory user password reset was completed, along with the account and authorized action required by your audit process. Never record either the temporary password or the user’s replacement password.