Reset a User Password in Active Directory

Before You Reset the Password

This procedure is for an on-premises Active Directory Domain Services account. It does not reset a consumer Microsoft account or a cloud-only Microsoft Entra account.

Use an administrator account that has permission to reset passwords for the user’s organizational unit. Domain-wide administrative membership is not always necessary because password-reset permission can be delegated. If the reset command is unavailable or access is denied, ask the domain administrator to verify your delegated permissions.

Identify the account by more than its display name. Confirm the user’s sign-in name, domain, organizational unit, and, when available, employee or ticket details. This prevents changing the wrong account when two people have similar names.

Before making changes, confirm whether the user is locked out, whether the account is enabled, whether the password must be changed at next sign-in, and how the temporary password will be delivered securely. Check whether the account runs a service or scheduled task, because resetting its password may also require updating stored credentials there.

Reset a Password in Active Directory Users and Computers

Active Directory Users and Computers is included with the appropriate Active Directory management tools. The computer must be able to contact the domain, and your signed-in account must have permission to reset the target user’s password.

1. Open Active Directory Users and Computers.
2. Expand the correct domain and browse to the organizational unit containing the user. You can also use the console’s search function.
3. Verify the account using its sign-in name and location, not only the displayed full name.
4. Select the user. On the Action menu, select Reset Password. You can also right-click the user and select Reset Password.
5. In New password, enter the temporary password. Enter it again in Confirm password.
6. Select User must change password at next logon when the user should create a private password after signing in.
7. If the dialog reports that the account is locked, select Unlock the user’s account when appropriate.
8. Select OK and confirm that the console reports a successful reset.

The new password must meet the domain policy. Do not place it in a ticket, ordinary email, chat history, or another location that people who do not need it can access.

Reset a User Password with PowerShell

The official PowerShell method uses the ActiveDirectory module and the Set-ADAccountPassword cmdlet. Install the Active Directory module through the applicable Windows Server or Remote Server Administration Tools components. Run PowerShell with credentials that have password-reset permission for the target account.

First, identify the account reliably. Get-ADUser can locate it by a unique sAMAccountName, distinguished name, GUID, or security identifier. Review the returned name, UserPrincipalName, distinguished name, and Enabled state before continuing.

Prompt for the password as a secure string so it is not exposed in the command line or saved in shell history:

$NewPassword = Read-Host -Prompt "Enter temporary password" -AsSecureString

Then reset the verified account:

Set-ADAccountPassword -Identity "verified-sAMAccountName" -Reset -NewPassword $NewPassword

The Identity value can instead be the verified distinguished name, GUID, or security identifier. Use a specific domain controller with the Server parameter when your procedures require both the reset and verification to use the same controller. To require a change at the next sign-in, use:

Set-ADUser -Identity "verified-sAMAccountName" -ChangePasswordAtLogon $true

Do not insert a real password directly into a command or script. The reset changes credentials; it does not automatically enable a disabled account or resolve every lockout condition.

Choose the Correct Password Options

User must change password at next logon is normally appropriate for a temporary password issued to a person. The user signs in with the temporary value and then chooses a private password. Do not select it blindly for service accounts or other noninteractive identities, which cannot respond to a password-change prompt.

Password never expires is a separate account setting, not a normal requirement for an Active Directory user password reset. Follow your organization’s policy before changing it. Conflicting settings, including User cannot change password, can prevent the required next-sign-in change.

Unlocking and resetting are related but separate actions. Select the unlock option only after confirming the lock status and considering whether an old password saved on another device, service, or application will immediately cause another lockout.

Domain password policy and any applicable fine-grained password policy control length, complexity, history, minimum age, and other requirements. A password that the dialog rejects must be replaced with one that satisfies the policy; administrators should not bypass those controls.

Confirm the Reset Worked

A success message from Active Directory Users and Computers or a PowerShell command that completes without error confirms that a domain controller accepted the active directory user password reset. You can then check the account’s Enabled, LockedOut, and PasswordLastSet properties without viewing the password.

Ask the user to sign in once from an approved device that can contact the domain. Have the user enter the credentials privately. Do not ask them to send the password back, and do not repeatedly attempt sign-in on their behalf. Repeated failures can lock the account and make diagnosis harder.

If a password change is required at next sign-in, success means the temporary password is accepted and the user can set a compliant private password. Afterward, confirm access to one ordinary domain resource appropriate for that user.

Fix Common Password Reset Problems

• Access is denied: Your account lacks password-reset permission for that user or organizational unit. Confirm delegation and whether the target is a protected or privileged account.

• Password is rejected: Check the effective domain or fine-grained password policy. Use a new value that meets complexity, length, and password-history rules.

• The old password still works somewhere: The device may be offline and using cached credentials. Connect it through an organization-approved path that can reach a domain controller, then sign in with the new password.

• The new password fails on another site or controller: Replication may not yet have carried the change to the controller handling that request. Verify against the controller that accepted the reset and investigate replication health rather than performing repeated resets.

• The account remains unusable: Check whether it is locked, disabled, expired, restricted by sign-in rules, or required to change its password. Resetting a password does not automatically correct all these states.

• No domain controller is available: Confirm domain connectivity, name resolution, management-tool configuration, and domain-controller health. The reset cannot be completed against an unavailable directory service.

• The account locks again: Look for devices, mapped resources, services, scheduled tasks, or applications that still submit the old password. Update or remove those saved credentials through your organization’s approved process.