How to Change User Password in AD via PowerShell

In this article we will see how to change (reset) the password of one or more Active Directory users from the PowerShell command line using the Set-ADAccountPassword cmdlet.

Most system administrators reset user passwords in AD using the dsa.msc (Active Directory Users & Computers – ADUC) snap-in. They simply find the user account in AD, right-click on it and select Reset password.

But it is not possible to use the ADUC console when you need to reset the password to multiple users at once. In this case, you can change AD passwords from the PowerShell command line.

Import Active Directory Module

To reset a user password in AD, the Set-ADAccountPassword cmdlet is used, which is included in the Active Directory module for Windows PowerShell. In Windows desktop versions it is included in RSAT, and in server editions it is installed as a separate component of AD DS Snap-Ins and Command-Line Tools. Before using the module, you must import it into a PowerShell session:

Import-module ActiveDirectory

Check for Password Reset Rights

To reset your password, your account must have the appropriate rights. Naturally, normal AD users by default cannot reset other accounts’ passwords for this feature to be available, the user (user group) must be delegated the right to reset the password on the AD container, or add it to the domain Account Operators group.

To verify that your account has the right to reset a particular user’s password, open its properties, go to the Security -> Advanced -> Effective Access tab, specify your account name and make sure that you have Reset Password permission.

Reset Password for a Single User Account

To reset a password for a user with a testuser logon name and set a new password to it, follow the command:

Set-ADAccountPassword testuser -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "newP@$$w0rD" -Force -Verbose) -PassThru

By default, the cmdlet returns the object and displays nothing in the console. To display information about the user object in AD we are using the -PassThru option.

As username you can specify SamAccountName (our case), objectGUID, SID of the user, or his DN (Distinguished Name, e.g. CN=TestUser,OU=Users,DC=testdomain,DC=com).

If you do not specify the -Reset parameter when changing the user password, you must specify the old password first and only then a new one.

Note. If the following error occurs when resetting the password using the Set-ADAccountPassword command:

Set-ADAccountPassword : The password does not meet the length, complexity, or history requirement of the domain.

This means that complexity, length or history requirements are defined in the domain password policy or granular password policy but the enetered password doesnt meet them.

If you have PowerShell command history enabled and you do not want passwords to be visible in the PoSh console, the password must be converted to a secure string:

$NewPwd=Read-Host "Enter new user password" -AsSecureString

Now let’s reset the password:

Set-ADAccountPassword testuser -Reset -NewPassword $NewPwd -PassThru

Additional Commands after Resetting User Account Password

When resetting a password, you can force unlock the user account even if it is locked using the following command afterwards:

Unlock-ADAccount -Identity testuser

In order to change a user password to a new one the next time he logs in to the domain, follow the command:

Set-ADUser -Identity testuser -ChangePasswordAtLogon $true

You can combine the command to change the password and enable the password change requirement in a single string:

Set-ADAccountPassword testuser -NewPassword $NewPwd -Reset -PassThru | Set-ADuser -ChangePasswordAtLogon $True

Verify the Password Change

Using the Get-ADUser command, you can verify that the password has been reset successfully by displaying the last time the account was changed:

Get-ADUser testuser -Properties * | select name, pass *

When the password is reset, EventID 4724 is logged on the domain controller (DC) in security settings of the event log. This event helps to define who has reset the password on the domain controller.

Change the Password of Several Users in AD at Once

We’ve showed you how to reset a single user’s password in AD using PowerShell. Lets consider another scenario where you need to change passwords of multiple users at the same time.

The simplest scenario is when you need to reset passwords of all users with certain account properties. For example, you need to force all employees from marketing department to reset their passwords to default password and force them to change their passwords the next time they log on:

get-aduser -filter "department -eq 'Marketing' -AND enabled -eq 'True'" | Set-ADAccountPassword -NewPassword $NewPasswd -Reset -PassThru | Set-ADuser -ChangePasswordAtLogon $True

Now let’s consider another case. Let’s say you have a CSV / Excel file that contains a list of users who need to reset passwords with a unique password for each user. The format of the file testusers.csv:

SamAccountName;NewPwd
testuser1;u9anklenX7Uf57d
testuser2;ucBclay4wcZKqQ
testuser3;vbullDJNxaG%y

With the following PowerShell script, you can reset the password for each account from the file:

Import-Csv testusers.csv -Delimiter ";" | Foreach {
$NewPwd = ConvertTo-SecureString -AsPlainText $_.NewPassword -Force
Set-ADAccountPassword -Identity $_.sAMAccountName -NewPassword $NewPwd -Reset -PassThru | Set-ADUser -ChangePasswordAtLogon $false
}

After this code is executed, a new unique password will be set for each user from the file.