We have a VPN that does not allow users to connect if they have a password change pending. Sometimes those users forget their passwords, or otherwise need them reset. In those cases, setting a temp password with "User must change password at next login" does not work because the VPN prevents them from logging in.

One solution is to uncheck this field and tell the user to change the password manually, but this runs afoul of our password policy, which requires the user to wait a day between password changes. That is insecure (and doesn't look very good). Is there a way to temporarily bypass the minimum password age requirement for one user? Bonus points if it's a PowerShell command, but I will accept any method.

enter image description here


Minimum Password Age (minPwdAge or msDS-MinimumPasswordAge) is not an attribute of user accounts, but rather an attribute of the domain itself. Changing it will affect all users of the domain. You can view the attribute in ADSI edit by right-clicking the root of the domain in the default naming context.

That said, you can override it using a Password Settings Object.


Attribute Name          Description                            Acceptable Values
msDS-MinimumPasswordAge Minimum Password Age for user accounts - None
                                                               - 00:00:00:00 through msDS-MaximumPasswordAge 
  • Not quite what I was hoping for, but it makes sense and you provided an alternate solution. Thanks! – David Jul 15 '13 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.