Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm not quite sure if this is possible or not, but I need to force a certain security group's users to have their passwords expire so they'll be forced to change them on next login. The reason for this is because I applied a FGPP (password policy) to this particular group in order to enforce strong passwords. Well, many users have really weak passwords and they won't be changed unless they're forced.

Is there a way to do this without forcing everyone to a single password?

share|improve this question
up vote 13 down vote accepted

You can do this in Powershell and Set-ADUser. Change the ChangepasswordatLogon flag to True.

Would look something like this:

Get-ADuser -Filter {memberof -RecursiveMatch "DN of Security Group"} | Set-ADuser -ChangePasswordatLogon:$true
share|improve this answer
I'd have to do this with each user, right? Suppose I can pull the list from the security group and loop it if I need to. – Nathan C Jun 5 '13 at 14:45
And as I post that it's edited with the filter :) i'll give it a try! – Nathan C Jun 5 '13 at 14:45
Yeah I updated it. That should work for you. – Mike Jun 5 '13 at 14:46
I just tried it and get a syntax error. I put in the DN of the group I'm attempting to use. – Nathan C Jun 5 '13 at 14:55
What is the error message? Did you put the DN in quotes if there are spaces in it? – Mike Jun 5 '13 at 15:04

If you prefer vbscript, even though why not use Powershell: A search for "vbscript set AD password to expired" yielded this article: How Can I Cause a User’s Password to Expire?

I haven't tested it personally. The sample vbscript code is:

Set objUser = GetObject("LDAP://CN=myerken,OU=Finance,DC=Fabrikam,DC=com")

objUser.pwdLastSet = 0

You can combine this with other code to get the list users from the security group (use the security group CN= in the LDAP query) and loop through them applying this password expiration. This is a good example of that found by searching "vbscript getobject security group": Get all users in specific AD group using VbScript

share|improve this answer

Here's a Command Prompt option:

for /f "delims=" %a in ('dsquery group -name "<INSERT_GROUP_NAME_HERE>" ^| dsget group -members -expand') do (
   dsmod user %a -mustchpwd yes
share|improve this answer
I'm so glad PowerShell now exists... – Ashley Steel Aug 8 '13 at 14:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.