7

I've got assigned an additional domain user account user2, with a password P@ssw0rd, that must be changed, before I can start using the account.

I don't want to log into user2 from the Windows logon screen; instead I want to change user2's password from my current user user1, and then use the user2 account using e.g. runas commands.

If I try to change user2's password by net user user2 NewP@ssw0rd /domain, I get the error:

System error 5 has occurred.

Access is denied.

How can I change user2's password without logging into the account from Windows logon screen?

Improve this question

1 Answer 1

Reset to default
10

You are attempting to reset the password using that command. The only way you can actually change a password is is by providing the old password as well as the new. These are two different operations, and require different permissions.

You can achieve this (changing another user's password without logging in as that account) one of two ways (that I easily recall from memory):

  1. While logged onto a domain computer (under any account), hit Ctrl+Alt+Del, choose "Change Password". Change the username from the current username to the username of the account whose password you wish to change. Enter that accounts current password, and the new password twice. That should change the password on the account.

  2. You can use the Set-ADAccountPassword cmdlet - again by providing both the oldpassword and newpassword values, and not using the Reset parameter.

Yes, its weird, but technically EVERYONE has the "Change Password" permission on every AD account - this allows unauthenticated users members of the EVERYONE special identity to change the password - as long as they know the current password.

Improve this answer
4
  • Thank you - by "unauthenticated users", you mean a user that's not logged in as the user, he is changing the password for? So, my command "resets" the password to a new password? - that's what I'd call a change of password, but apparently it is called a reset without providing the old password? :)
    – Shuzheng
    Nov 19, 2018 at 16:20
  • Well, I'm specifically referring to the "EVERYONE special identity which is clearly defined as "interactive, network, dial-up, and authenticated users' (docs.microsoft.com/en-us/windows/security/identity-protection/…), so I should re-edit my answer to link to the definition of the EVERYONE special identity.
    – Semicolon
    Nov 19, 2018 at 16:57
  • If you're not concerned about the differences between changing and resetting, and simply want the account to have a new password. That's a different matter - and I read too deeply into the question. If you are unable to reset the password, then you'll need to confirm that you're running under an account that has appropriate permissions to reset the objects password, you are running the command prompt elevated (if on a DC), and are not supplying a password that violates your domain's password policy.
    – Semicolon
    Nov 19, 2018 at 17:05
  • Thank you - I want to set a password for a new user (with a password set by the domain administartor), that cannot be used before it has its password changed. So according to you, I need to change and not reset (like the process of Windows logon screen, where I first supply the current password and then set a new)
    – Shuzheng
    Nov 19, 2018 at 18:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .