Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I force all domain users to change their password now? I want to do so before users next logon.


share|improve this question
All domain users? Including Administrator and other built in accounts? – jscott Apr 8 '13 at 15:02
Meh, I wanted to try to answer but on second thought, I don't want to go down this rabbit hole. The answers given so far don't force the logoff of logged on users, and that's what you said you wanted. I think we're still waiting on that answer. – Ryan Ries Apr 8 '13 at 16:12
Thanks everyone....I just wrote a policy for users to change password at next logon. I thought it was possible to prompt/force users to immediately change their password. Thanks again for all your input. Regards – Invnet Apr 8 '13 at 18:19
up vote 2 down vote accepted

Use a combination of dsquery and dsmod


dsquery user "OU=Sales,OU=New York,dc=internal,dc=AcmeCorp,dc=com" | dsmod user -pwd ChangeThisNow! -mustchpwd yes -u Admin -p APassword

This would change password of all users in Sales in New York to "ChangeThisNow!" and force them to change it on login.

Here's a reference on dsmod

share|improve this answer
So you're going to change every domain user to have the same password, and then you're going to tell them all what everyone else's password is? – Ryan Ries Apr 8 '13 at 15:15
I'd recommend doing the dsmod but setting the account to expire in the past. dsquery user "OU=Sales,OU=New York,dc=internal,dc=AcmeCorp,dc=com" | dsmod user -acctexpires -5 – Snowburnt Apr 8 '13 at 15:21

If you are using PowerShell, this command will force all users in the current domain to choose a new password next time they log in.

Get-ADUser -Filter "*" | Set-ADUser -ChangePasswordAtLogon $true

If you want to be more precise about which users are affected, you can narrow it down to an organizational unit.

$users = Get-ADUser -Filter "*" -SearchScope Subtree -SearchBase 'DC=contoso,DC=com'
$users | Set-ADUser -ChangePasswordAtLogon $true

More options can be found here: Migrated Users Get Prompted To Change Password at First Logon (

share|improve this answer
Shouldn't there be, at least, a -Filter * in that first Get-ADUser example? As written, it doesn't work without additional prompting. – jscott Apr 8 '13 at 15:37
@jscott Thanks for the correction. I'm more accustomed to Get-QADUser which does not require the -Filter parameter. – Nic Apr 8 '13 at 15:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.