15

I'm a developer at my organization, but I've been tasked with resetting the passwords on 10k e-mail users in an OU in Active Directory. I was given the proper permissions, then sent the following TechNet article, but I'm not sure where I'd run this or how exactly it works. I apologize if this question is too vague, but I wasn't sure where else I could ask (I'd ask a sysadmin at my organization, but it'd take a while for response). Could someone give me a rundown of what exactly this cmdlet does and how I'd go about executing this?

2
  • 3
    All the same password, or do they all require different passwords? As I'm sure you're aware, 10k users with the same password isn't the greatest idea in the world... Nov 29, 2010 at 20:58
  • All the same password. It just happens to work in our scenario, we understand how backwards this sounds, and the users will change password upon next logon. Nov 29, 2010 at 21:32

4 Answers 4

29

Much easier than that. Install the (depending on your flavour of your workstation OS) Remote Server Administration Tools so you get the AD DS tools. Don't forget to go into your Windows Features in Control Panel to enable the correct toolsets.

Once you've done that, the following command will achieve your desired result:

DSQUERY user "OU=myOU,OU=myUsers,DC=myDomain,DC=loc" -limit 0 | DSMOD user -pwd <insert new password here>

~ Replace "OU=myOU,OU=myUsers,DC=myDomain,DC=loc" with the distinguishedName of the OU containing the users to be changed

9
  • Would I do this in the Active Directory Module for PowerShell? Nov 29, 2010 at 21:47
  • 2
    izzy's solution works from the regular ol' cmd.exe command shell :) Nov 29, 2010 at 22:02
  • I ran the command, replacing the string as indicated "OU=Users,OU=External Users,DN=ourdomain,DN=org", but I get the following error: "dsquery failed:No superior reference has been configured for the directory service." Nov 29, 2010 at 22:20
  • Nevermind, read around and apparently instead of DN I was supposed to use DC. Not sure why, if anyone could explain I'd be grateful. Thanks for your help everyone. :) Nov 29, 2010 at 22:37
  • 2
    DN stands for "Distinguished name" and is a way of uniquely identifying any object in the directory tree. DC stands for "Domain Component", OU for Organisational Unit and CN for Common Name. A DN is made up of DC, OU and CN parts. If your domain is corp.acme-widgets.local and Joe Bloggs is in an OU called Sales which is in an OU called Users, Joe Bloggs' DN would be CN=Joe Bloggs,OU=Sales,OU=Users,DC=corp,DC=acme-widgets,DC=local Nov 29, 2010 at 23:31
5

I just want to throw this out there and say this is a horrible idea. If the need to change 10K user passwords is present, a bulk reset should not be part of the process. At best, simply forcing a change next time a user logs on would prevent the gigantic security hole you are opening.

3
  • Should be a Community Wiki answer
    – Izzy
    Nov 30, 2010 at 22:20
  • Bulk reset isn't necessarily a terrible idea, if you are using unique passwords, i.e. resetting passwords to social security numbers or some other piece of private info known to the company. However I agree resetting 10k of accounts to the same password is a TERRIBLE idea. I don't understand how forcing a password change accomplishes the same-thing, unless the account is locked out from checking mail until the password is changed. Dec 28, 2010 at 8:50
  • For our case, we are doing a bulk reset, to the same password for all users (they don't know that) because we have learned that people are using other people's accounts. So when their password doesn't work, they are going to call in, and then we'll verify who they are...
    – ganders
    Feb 12, 2013 at 15:08
4

Here's a PowerShell variant to add to the mix. Run this from the Active Directory Modules for Windows Powershell. Note that the password must meet any requirements (length, complexity etc) specified by domain policy.

Things you'll need to change in this are the -SearchBase parameter and the -NewPassword parameter.

Use Import-Module ActiveDirectory to add the Active Directory Modules into the default PowerShell.

Get-ADUser -Filter * -SearchScope Subtree -SearchBase "OU=Department,OU=Users,DC=corp,DC=acme-widgets,DC=local" | Set-ADAccountPassword -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "New Password Here" -Force)

To see what users this will affect before you run the command above, issue this command to give you a list of affected accounts.

Get-ADUser -Filter * -SearchScope Subtree -SearchBase "OU=Reset Pwd 2,OU=Reset PWD 1,DC=corp,DC=acme-widgets,DC=local" | Ft Name

0

I think bulk resetting 10k passowords is not good idea. Simply we can choose option "change at next logon" It will ensure that we are not breaking any Information Security policy or process. GN

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .