How do I change my Windows domain password when my PC is not on the domain?

Question

How do I change my Windows domain password when my PC is not on the domain?

I know Outlook web access normally provides this option, but that option has been switched off.

Answer 1

Turns out this is actually fairly simple. On the change password screen, accessed by hitting ctrl+alt-delete at the computer (or remotely*) you can actually edit the user name to something else, such as adding a domain specifier in front of the user name. Yes this works even if the computer is not in the domain but is on the network.

So there are a few ways to go about it.

So what I actually just tested was to connect the the machine remotely. Sent ctrl+alt+del through the remote desktop program. Picked change password. Changed the username, in my case my username with the "mydomain\" prefixed (in front) of it. Change it to your actual domain of course and the exact user name if it differs on the domain. Hit enter. Voila! Done.

So you can do this on any computer you have access to in the domain with any other user, physically/locally or remotely. Open the change user name screen and change the user name to the fully qualified/specified user name, meaning with the domain name in front of it followed by "\", such as: domainname\yourusername.

*= remotely accessing your computer with software such as Microsoft Windows Remote Desktop, Chrome remote desktop, Team viewer etc, and making the equivalent of a ctrl+alt+del. In microsoft Remote desktop by hitting ctrl+alt+end. In Chrome remote desktop, https://remotedesktop.google.com, you do this in a menu.

Of course accessing a machine remotely might or might not meen you need vpn access with the same login that is expired... However hopefully those are two different logins if so.

Cloud services for remote access, such as Chrome remote desktop, team viewer, ssh tunnels, etc are potentially unauthorized/dangerous and most likely prohibited backdoors that could in some cases circumvent this catch-22 situation with an expired vpn access. Make sure you are allowed the make use of those if tempted, they are most likely not, for good reasons.

Answer 2

As far as my knowledge goes, you have to be connected to the domain and logged in with the username you want to change password for, in order to actually change it (at least in the domain).

You can always try pressing Ctrl + Alt + Del and select Change password and see how that works for you.

Answer 3

As mentioned by sub-star, domain controller connection is required in order to change the user password. Here is some information regarding caching of password: When you log on, Windows remembers the password, and when you attempt to unlock a locked workstation, the password you enter is compared to the password you used to log on. If they match, then Windows proceeds to unlock the workstation, even though the password might be stale. This behavior is a network performance optimization to avoid network traffice requests to domain controller over slow network connections. The cached password mechanism is used to let users access local machine resources.Once the user tries to access a network resource, that network resource will ask the domain controller to verify users authenticity.

Answer 4

Snark's link above doesn't seem to work for me. This link works and looks like it might address the OP's question:

TechNet Magazine > Columns > Windows Confidential > Windows Confidential Cached Credentials Raymond Chen https://technet.microsoft.com/en-us/library/2009.07.windowsconfidential.aspx

Answer 5

If your company uses Office365, you can go to MyAccount and click on "Manage security & privacy" and then "password". This will open a new tab that contains the familiar password changing dialog. After successfully completing the dialog, your password will have been changed on the domain controller. When you next get the opportunity, VPN or directly-connect to the corporate network. Your machine will synchronize with the domain controller and cache the new password, for which it will then prompt you. After you have been prompted, locking and unlocking (or restarting) your machine will put you back in a fully-synchronized, authenticated state.