How to Reset an Active Directory User Password using PowerShell

The Most Common IT Task

Resetting a forgotten user password is the most frequent ticket submitted to any corporate IT Helpdesk. While technicians usually rely on the graphical Active Directory Users and Computers (ADUC) tool, clicking through multiple windows to find the user, right-clicking, and typing the password twice is inefficient.

If you want to build a self-service password reset portal, or simply execute the task faster from your administrative terminal, PowerShell provides a dedicated cmdlet to securely reset AD credentials.

The Requirement for Secure Strings

PowerShell is designed with strict security constraints. It will completely refuse to pass a plain-text password across the network to a Domain Controller. Before you can use the password reset cmdlet, you must convert the new temporary password into a cryptographically secure SecureString object.

To convert a standard string (like Welcome2025!) into a SecureString, run the following command in your PowerShell prompt:

$TempPassword = ConvertTo-SecureString "Welcome2025!" -AsPlainText -Force

If you try to type $TempPassword into the terminal now, PowerShell will not output the text; it will simply output the object type (System.Security.SecureString), proving the string is masked in memory.

Executing the Reset Command

Now that you have a secure payload, you can use the Set-ADAccountPassword cmdlet. You must be running the Active Directory module (RSAT) and possess delegated password reset permissions over the user.

Assuming the user’s login ID is JSmith, execute the following command:

Set-ADAccountPassword -Identity "JSmith" -NewPassword $TempPassword -Reset

The command will execute silently, and the user’s Active Directory password is instantly changed.

Forcing a Password Change on Next Login

Security best practices dictate that an IT technician should never know an employee’s permanent password. The Welcome2025! password should only be a temporary bridge.

To enforce this, you must flag the user’s account to require an immediate password change the very next time they successfully authenticate. This cannot be done with the Set-ADAccountPassword cmdlet; it must be done with the broader Set-ADUser cmdlet.

Run this command immediately after the reset:

Set-ADUser -Identity "JSmith" -ChangePasswordAtLogon $true

Now, when JSmith enters the temporary password, Windows will refuse to load the desktop, presenting a prompt stating, “The user’s password must be changed before signing in.” The user will then create their own, private permanent password.