Skip to main content
AD Academy
Back to all recipes
Level: JuniorLast updated:

Reset a password and force a change at next logon

Set-ADAccountPassword -Identity jdoe -Reset `
  -NewPassword (Read-Host -AsSecureString "New password")
Set-ADUser -Identity jdoe -ChangePasswordAtLogon $true

Why it works this way

Helpdesk standard: a temporary password the user must change immediately.

Command breakdown

ParameterWhy it works this way
-ChangePasswordAtLogonForces the user to set their own password at next logon — so you never know it.

Caution

Verify identity by phone or via the manager before resetting — social engineering starts with exactly this call.

Watch out

  • Never email the password — use a separate channel and verify identity.
  • If it locks again immediately, hunt event 4740 and the source.

Related events