I'm not quite sure if this is possible or not, but I need to force a certain security group's users to have their passwords expire so they'll be forced to change them on next login. The reason for this is because I applied a FGPP (password policy) to this particular group in order to enforce strong passwords. Well, many users have really weak passwords and they won't be changed unless they're forced.

Is there a way to do this without forcing everyone to a single password?


You can do this in Powershell and Set-ADUser. Change the ChangepasswordatLogon flag to True.

Would look something like this:

Get-ADuser -Filter {memberof -RecursiveMatch "DN of Security Group"} | Set-ADuser -ChangePasswordatLogon:$true
  • I'd have to do this with each user, right? Suppose I can pull the list from the security group and loop it if I need to. – Nathan C Jun 5 '13 at 14:45
  • And as I post that it's edited with the filter :) i'll give it a try! – Nathan C Jun 5 '13 at 14:45
  • Yeah I updated it. That should work for you. – Mike Jun 5 '13 at 14:46
  • I just tried it and get a syntax error. I put in the DN of the group I'm attempting to use. – Nathan C Jun 5 '13 at 14:55
  • What is the error message? Did you put the DN in quotes if there are spaces in it? – Mike Jun 5 '13 at 15:04

If you prefer vbscript, even though why not use Powershell: A search for "vbscript set AD password to expired" yielded this article: How Can I Cause a User’s Password to Expire?

I haven't tested it personally. The sample vbscript code is:

Set objUser = GetObject("LDAP://CN=myerken,OU=Finance,DC=Fabrikam,DC=com")

objUser.pwdLastSet = 0

You can combine this with other code to get the list users from the security group (use the security group CN= in the LDAP query) and loop through them applying this password expiration. This is a good example of that found by searching "vbscript getobject security group": Get all users in specific AD group using VbScript


Here's a Command Prompt option:

for /f "delims=" %a in ('dsquery group -name "<INSERT_GROUP_NAME_HERE>" ^| dsget group -members -expand') do (
   dsmod user %a -mustchpwd yes
  • 1
    I'm so glad PowerShell now exists... – Ashley Aug 8 '13 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.