I have an active directory server where users are divided in various security groups, and I've been trying to find a way to reset passwords for all of them at once.

So first I thought I could just use dsquery. The command

dsquery group -name "<group>" -uc | dsget group -members -uc 

got me the strings for all of the users. This is nice and all, but when I piped the output to a file cmd always saved it as a ANSI file no matter the codepage settings etc. This corrupted the output and I couldn't load it back to loop through it, and you can't easily store the output of a piped programs to a variable in batch, so that was out of the window.

dsquery on powershell simply refused to work. With DN or not, it always said that "directory object couldn't be found". (As seen here.).

Same with Get-ADUser and Get-ADGroup etc. commands from the powershell's AD Module (like the ones described here). They either timed out or they simply exited without returning anything. No error, no success message, nothing. Of course passwords remain unchanged.

So the question is: how do I change passwords for an entire group at once?


Something like Get-AdGroupMember -Identity 'GroupName' -Recursive should get you the list of users; if the list looks right, then Get-AdGroupMember -Identity 'GroupName' -Recursive | Set-AdAccountPassword -Reset -NewPassword 'SomePassword' should change them all.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.