Unlock Windows AD account & assign temporary password via command line?

Question

Joe Brown is on the phone. He is locked out of Windows because he has forgotten his password. We could reset his password via Active Directory Users and Computers, but ADUC is very annoyingly clicky.

Of course, it's also possible to unlock Joe Brown's account and reset his password to "33Foo$bars" via NET USER:

net user jbrown 33Foo$bars /domain /active:yes

Unfortunately, the flag requiring him to choose a new password is not set by this command. We, being enlightened administrators, do not want to know any user's permanent password at any time.

Does anyone have an efficient command-line method to unlock/reset and require a password change, using native Windows tools (including PowerShell or VBScript if necessary) but no 3rd-party binaries?

Context: Windows Server 2008 domain.

sysadmin1138 · Accepted Answer · 2010-09-15T16:55:35.563

13

The binary 'dsmod' (comes with Win7 and Vista, and somewhere along the way XP got them too) should do what you want.

dsmod user UserDN -pwd $Password -mustchpwd yes

It can do a lot more as well! Very useful tool.

There are a couple of other tools along side that one that are quite useful as well. dsquery searches AD from command-line. dsget pulls attributes from objects. dsadd allows creating objects (and users!). Definitely worth a look for any scripter.

edited Sep 15 '10 at 16:55

answered Sep 15 '10 at 16:40

sysadmin1138

131,083
18
173
296

The ds* tools were new in Server 2003 – mfinni Sep 15 '10 at 16:53
8

+1, but DNs take *way* too long to type `dsquery user -samid username | dsmod user -mustchpwd yes -pwd password` – jscott Sep 15 '10 at 16:53
Thanks very much. Especially with the addition of @jscott's comment, this is a perfect solution. – Skyhawk Sep 15 '10 at 18:07

mfinni · Answer 2 · 2010-09-15T17:18:07.797

2

Untested, but I've done stuff like this before with DSMod user

dsquery user -samid username | dsmod.exe user -pwd <Password> -mustchpwd yes -disabled no

/edited - includes the good suggestion to prepend with dsquery to let you look up the samid (login) instead of the UDN.

edited Sep 15 '10 at 17:18

answered Sep 15 '10 at 16:51

mfinni

35,711
3
50
86

score 0 · Answer 3 · answered Sep 15 '10 at 17:38

0

To reset a user's password and force password change:

dsmod user "CN=John Doe,CN=Users,DC=microsoft,DC=com" -pwd A1b2C3d4 -mustchpwd yes

answered Sep 15 '10 at 17:38

gWaldo

11,887
8
41
68

score 0 · Answer 4 · edited Oct 11 '12 at 18:35

0

This just worked for me on my Win7 box.

net user *username* *password*/domain ACTIVE:Yes /logonpasswordchg:yes

edited Oct 11 '12 at 18:35

Scott Pack

14,717
10
51
83

answered Jul 18 '12 at 19:33

LucMaN

1

I tried this, but it did not force a password change – dzampino Aug 21 '15 at 17:19

Unlock Windows AD account & assign *temporary* password via command line?

4 Answers4

Unlock Windows AD account & assign temporary password via command line?