Set-ADAccountPassword -Reset: reset an Active Directory user password with PowerShell

To reset a user's password in Active Directory with PowerShell, run Set-ADAccountPassword -Identity USER -Reset -NewPassword (Read-Host -AsSecureString 'New password'), then Set-ADUser -Identity USER -ChangePasswordAtLogon $true so the user picks their own password at the next logon. Both cmdlets are in the ActiveDirectory module that comes with RSAT or a domain controller.

Import-Module ActiveDirectory
$new = Read-Host -AsSecureString 'New password for adele'
Set-ADAccountPassword -Identity adele -Reset -NewPassword $new
Set-ADUser -Identity adele -ChangePasswordAtLogon $true
Unlock-ADAccount -Identity adele      # only if the account is locked out

Replace adele with the user's sAMAccountName, distinguished name, GUID or SID. The cmdlet prints nothing on success; add -PassThru to get the account object back.

Parameters

If you leave out both password parameters, the cmdlet prompts for the current and the new password interactively, so scripts should always pass -NewPassword.

Reset several accounts

Import-Csv .\reset.csv | ForEach-Object {
  $pw = ConvertTo-SecureString $_.TempPassword -AsPlainText -Force
  Set-ADAccountPassword -Identity $_.SamAccountName -Reset -NewPassword $pw
  Set-ADUser -Identity $_.SamAccountName -ChangePasswordAtLogon $true
}

Requirements and limits

• The account running the command needs the Reset password permission on the target object, for example as a domain administrator or through delegated control on the user's OU. Without it, Microsoft's reference says the module returns a terminating error.
• The new password must satisfy the domain password policy (length, complexity, history), or the domain controller rejects it.
• Microsoft notes that the cmdlet does not work against a read-only domain controller, an AD snapshot, or the global catalog port.
• Group managed service accounts cannot have their password set; Windows changes it on a schedule.
• For users synced to Microsoft Entra ID, reset the password in AD; for cloud-only accounts use Update-MgUser -PasswordProfile.

Errors

Fixes: Get-ADUser is not recognized (the same module), Cannot find an object with identity, and installing RSAT on Windows 11. The module works in Windows PowerShell 5.1 and, on Windows, in PowerShell 7.

FAQ