OSX Server 10.8.2 - Change domain password (command line)

Question

How do i go about changing the domain password for a user? Assuming i'm running a admin account, is there a command or method to change a users password without a GUI?

Also, previous password is unknown so sudo passwd doesn' work (it requires me to have the old passwod).

Answer 1

Being an admin (or root) on the local computer is irrelevant to the domain controller -- in order to reset a domain user's password, you need to authenticate to the domain controller using domain admin credentials. You can do this from OS X with the dscl command. Here's an example of resetting the password for the user "fred" in the LDAP domain named "domaincontroller.com", by authenticating as the domain admin "diradmin":

dscl -u diradmin -p /LDAPv3/domaincontroller.com -passwd /Users/fred

Note that -p tells it to prompt for the domain admin's password; -P "password" would specify the admin's password on the command line, which is not recommended for security reasons. Also, if you're not sure what the appropriate nodename for the domain is (/LDAPv3/domaincontroller.com in the above example), check the user's meta node location:

dscl /Search -read /Users/fred | grep "^AppleMetaNodeLocation"