Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am writing a self service password reset tool for users in my test domain. I would like them to be able to change passwords and not generate a random password.

I am using dsmod with a service account to change user passwords and it was working fine, (ie was throwing an error when setting a user's password to a previous one or if the password wasn't complex enough).

dsquery user -samid someuser | dsmod user -pwd somepassword -mustchpwd no

For some reason today it will take any password and change it. Changing through the GUI is enforcing policies.

Does anyone know what is going on or how to enforce this with another tool?

share|improve this question
Have you actually verified that the user can log in with the non-compliant password? And have you actually looked at your Default Domain Policy to make sure that another admin didn't go through and clobber your password settings? – MDMarra Mar 1 '13 at 23:46
I have verified the user can log in. I just tested - the complexity check is there, the password history requirement is not. – mphuie Mar 1 '13 at 23:49
Are there any fine-grained password policies defined for your domain? This is a crazy problem. – MDMarra Mar 2 '13 at 0:51
@mphuie " the complexity check is there, the password history requirement is not" there's a difference between "resetting" a password and allowing a user to change their own password. If you service account has the privilege to reset a user's password, then only complexity rules apply, not history – jscott Mar 2 '13 at 1:00
Yeah, @jscott has a good point. Can you define the exact problem? What part of the password policy is this letting you bypass? I assumed you were saying it wasn't respecting length/complexity requirements. – MDMarra Mar 2 '13 at 1:03

There's a subtle but important difference in the two following things:

  1. A user (your service account) granted the "Reset Password" right on another account, or an Administrator, performing a password reset on that other account.

  2. A user (normal user) performing a "Change Password" for their own account.

In both cases, as you saw, the domain's password rules apply slightly different. With a "Reset Password" operation, it's an administrative action -- it's not subject to the minimum password age or "remember last n passwords used" rules. In addition, you don't need to know the current password for a Reset Password operation as you would for a "normal" Change Password.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.