Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using a powershell script I found online, trying to use a win7 cpu to remotely change passwords on a Windows Server 2008 via RSAT. Right now, the server 2008 and win7 are VM's, and the win7 cpu is domained to the server and can properly run the Active Directory Module for powershell. I am pretty new to powershell and dealing with servers [this project is my training at my internship], and I'm getting an error when trying to compile this script.

import-Module ActiveDirectory
Function Set-AdUserPwd 
    ) #end param 
    $oUser = [adsi]"LDAP://$user" 
} # end function Set-AdUserPwd 
    Set-AdUserPwd -user "cn=test,ou=Users,dc=ifrit,dc=local" -pwd P@ssword1

Exception calling "Invoke" with "2" argument(s): "There is no such object on the server.
At line:10 char:25
+     $ouser.psbase.invoke <<<< ("SetPassword",$pwd) 
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DotNetMethodException

I thought maybe 'invoke' was something only on powershell 3, but upon looking at the technet article, it says it applies to powershell 2, also. I have an account in AD as 'test', but I'm unsure if that's the actual common name (First Name: Test, Last Name: Test, User Logon Name: test@ifrit.local) Can someone tell me if the exception is referring that I have an incorrect CN OR is it something entirely else?

share|improve this question
If you plan on using ADSI, you needn't the Active Directory module. – jscott Sep 5 '13 at 22:52
Why not Set-ADAccountPassword? Why are you building your own function? – Zoredache Sep 5 '13 at 23:08
If the domain is still at 2008 (not 2008R2) functional level, the AD modules won't work without Active Directory Management Gateway Service. – jscott Sep 5 '13 at 23:14
to clarify, I am writing a script so that other people can just run and input a first and last name, and the script will return some information (phone number/email) for verification. Then, the user will be prompted to reset the password and ask for another input. I have already installed the ADMGS already because it's a 2008 Server (thanks jscott). ] – Bob Sep 6 '13 at 1:30

Agree with the comments above.

You can drop the references to ADSI (Active Directory Scripting Interface), as this is the "old" way of doing things; the Active Directory PS module has been designed to replace it.

So, in your instance, you first need to confirm that the user object exists. You can do this using the Get-ADUser cmdlet, based on whatever search criteria you choose. Now, at this stage, I'd suggest making the search quite prescriptive, that is so you only return one user object, e.g.:

try {
    $objUser = Get-ADUser -Filter { Name -eq $user }
    // rest of code here
    Write-Host "ERROR : Failed to locate user.";

You can then use the Set-ADAccountPassword cmdlet to reset the password (see hyperlink). This requires the Distinguished Name (DN) of the user, which will be an attribute of your $objUser object returned by Get-ADUser call.

I can't test this from here, so if you try this from an interactive PowerShell prompt, you can see what attributes exist for your $objUser object:

$test = Get-ADUser -Filter { Name -eq "jimbob" }
$test | Get-Member

I suspect there's a DN or DistinguishedName attribute, but like I say, I can't test from here.

Have a go, and update here with progress, if you need more assistance...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.