I'm a developer at my organization, but I've been tasked with resetting the passwords on 10k e-mail users in an OU in Active Directory. I was given the proper permissions, then sent the following TechNet article, but I'm not sure where I'd run this or how exactly it works. I apologize if this question is too vague, but I wasn't sure where else I could ask (I'd ask a sysadmin at my organization, but it'd take a while for response). Could someone give me a rundown of what exactly this cmdlet does and how I'd go about executing this?

  • 3
    All the same password, or do they all require different passwords? As I'm sure you're aware, 10k users with the same password isn't the greatest idea in the world... – Ben Pilbrow Nov 29 '10 at 20:58
  • All the same password. It just happens to work in our scenario, we understand how backwards this sounds, and the users will change password upon next logon. – Christopher Garcia Nov 29 '10 at 21:32

Much easier than that. Install the (depending on your flavour of your workstation OS) Remote Server Administration Tools so you get the AD DS tools. Don't forget to go into your Windows Features in Control Panel to enable the correct toolsets.

Once you've done that, the following command will achieve your desired result:

DSQUERY user "OU=myOU,OU=myUsers,DC=myDomain,DC=loc" -limit 0 | DSMOD user -pwd <insert new password here>

~ Replace "OU=myOU,OU=myUsers,DC=myDomain,DC=loc" with the distinguishedName of the OU containing the users to be changed

| improve this answer | |
  • Would I do this in the Active Directory Module for PowerShell? – Christopher Garcia Nov 29 '10 at 21:47
  • 2
    izzy's solution works from the regular ol' cmd.exe command shell :) – cheeseprocedure Nov 29 '10 at 22:02
  • I ran the command, replacing the string as indicated "OU=Users,OU=External Users,DN=ourdomain,DN=org", but I get the following error: "dsquery failed:No superior reference has been configured for the directory service." – Christopher Garcia Nov 29 '10 at 22:20
  • Nevermind, read around and apparently instead of DN I was supposed to use DC. Not sure why, if anyone could explain I'd be grateful. Thanks for your help everyone. :) – Christopher Garcia Nov 29 '10 at 22:37
  • 1
    DN stands for "Distinguished name" and is a way of uniquely identifying any object in the directory tree. DC stands for "Domain Component", OU for Organisational Unit and CN for Common Name. A DN is made up of DC, OU and CN parts. If your domain is corp.acme-widgets.local and Joe Bloggs is in an OU called Sales which is in an OU called Users, Joe Bloggs' DN would be CN=Joe Bloggs,OU=Sales,OU=Users,DC=corp,DC=acme-widgets,DC=local – Ben Pilbrow Nov 29 '10 at 23:31

I just want to throw this out there and say this is a horrible idea. If the need to change 10K user passwords is present, a bulk reset should not be part of the process. At best, simply forcing a change next time a user logs on would prevent the gigantic security hole you are opening.

| improve this answer | |
  • Should be a Community Wiki answer – Izzy Nov 30 '10 at 22:20
  • Bulk reset isn't necessarily a terrible idea, if you are using unique passwords, i.e. resetting passwords to social security numbers or some other piece of private info known to the company. However I agree resetting 10k of accounts to the same password is a TERRIBLE idea. I don't understand how forcing a password change accomplishes the same-thing, unless the account is locked out from checking mail until the password is changed. – JamesBarnett Dec 28 '10 at 8:50
  • For our case, we are doing a bulk reset, to the same password for all users (they don't know that) because we have learned that people are using other people's accounts. So when their password doesn't work, they are going to call in, and then we'll verify who they are... – ganders Feb 12 '13 at 15:08

Here's a PowerShell variant to add to the mix. Run this from the Active Directory Modules for Windows Powershell. Note that the password must meet any requirements (length, complexity etc) specified by domain policy.

Things you'll need to change in this are the -SearchBase parameter and the -NewPassword parameter.

Use Import-Module ActiveDirectory to add the Active Directory Modules into the default PowerShell.

Get-ADUser -Filter * -SearchScope Subtree -SearchBase "OU=Department,OU=Users,DC=corp,DC=acme-widgets,DC=local" | Set-ADAccountPassword -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "New Password Here" -Force)

To see what users this will affect before you run the command above, issue this command to give you a list of affected accounts.

Get-ADUser -Filter * -SearchScope Subtree -SearchBase "OU=Reset Pwd 2,OU=Reset PWD 1,DC=corp,DC=acme-widgets,DC=local" | Ft Name

| improve this answer | |

I think bulk resetting 10k passowords is not good idea. Simply we can choose option "change at next logon" It will ensure that we are not breaking any Information Security policy or process. GN

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.