1

How can I force all domain users to change their password now? I want to do so before users next logon.

Thanks

3
  • 3
    All domain users? Including Administrator and other built in accounts?
    – jscott
    Apr 8, 2013 at 15:02
  • Meh, I wanted to try to answer but on second thought, I don't want to go down this rabbit hole. The answers given so far don't force the logoff of logged on users, and that's what you said you wanted. I think we're still waiting on that answer.
    – Ryan Ries
    Apr 8, 2013 at 16:12
  • 2
    Thanks everyone....I just wrote a policy for users to change password at next logon. I thought it was possible to prompt/force users to immediately change their password. Thanks again for all your input. Regards
    – Invnet
    Apr 8, 2013 at 18:19

2 Answers 2

2

Use a combination of dsquery and dsmod

eg

dsquery user "OU=Sales,OU=New York,dc=internal,dc=AcmeCorp,dc=com" | dsmod user -pwd ChangeThisNow! -mustchpwd yes -u Admin -p APassword

This would change password of all users in Sales in New York to "ChangeThisNow!" and force them to change it on login.

Here's a reference on dsmod

2
  • 7
    So you're going to change every domain user to have the same password, and then you're going to tell them all what everyone else's password is?
    – Ryan Ries
    Apr 8, 2013 at 15:15
  • 2
    I'd recommend doing the dsmod but setting the account to expire in the past. dsquery user "OU=Sales,OU=New York,dc=internal,dc=AcmeCorp,dc=com" | dsmod user -acctexpires -5
    – Snowburnt
    Apr 8, 2013 at 15:21
5

If you are using PowerShell, this command will force all users in the current domain to choose a new password next time they log in.

Get-ADUser -Filter "*" | Set-ADUser -ChangePasswordAtLogon $true

If you want to be more precise about which users are affected, you can narrow it down to an organizational unit.

$users = Get-ADUser -Filter "*" -SearchScope Subtree -SearchBase 'DC=contoso,DC=com'
$users | Set-ADUser -ChangePasswordAtLogon $true

More options can be found here: Migrated Users Get Prompted To Change Password at First Logon (blogs.technet.com).

3
  • 1
    Shouldn't there be, at least, a -Filter * in that first Get-ADUser example? As written, it doesn't work without additional prompting.
    – jscott
    Apr 8, 2013 at 15:37
  • @jscott Thanks for the correction. I'm more accustomed to Get-QADUser which does not require the -Filter parameter.
    – Nic
    Apr 8, 2013 at 15:50
  • Does this affect accounts once or continuously? In other words, will users affected by this have to change their password every time they log on, or will the flag clear once they've changed it once?
    – TylerH
    Nov 13, 2018 at 22:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .