Home · Lessons

Account support

How to reset a user's Active Directory password

A user has forgotten their password. Resetting it is one of the most common help desk tasks, and one of the easiest to get wrong. This lesson covers the order of steps: check who is asking, reset, make the user change the password at first sign-in, and confirm the result.

1. Check who is asking

Before you reset anything, confirm the request came from the account owner, or from someone allowed to make it. Use your team's verification steps, such as a call-back to a known number or a manager's approval. A password reset is the way an attacker gets into an account, so this step is not optional, even when the request sounds routine.

2. Unlock the account if it is locked

A locked account can't sign in even with the right password. If the user is locked out too, unlock the account first and check the cause. Repeated lockouts after a reset usually mean an old password is still being used somewhere.

Unlock-ADAccount -Identity msantos

3. Reset the password

Set a temporary password with the -Reset switch. Use a value that meets your password policy and that you can share with the user securely, not in an open chat or a ticket comment.

Set-ADAccountPassword -Identity msantos -Reset -NewPassword (ConvertTo-SecureString 'Temp!2026' -AsPlainText -Force)

In a real environment, avoid typing a password into a command that might be saved in shell history. Many teams use a password generator and a secure channel instead. The lab uses a plain value so you can practise the steps.

4. Require a change at first sign-in

Set the change-at-logon flag after the reset. Resetting the password clears this flag, so setting it first has no effect. This is the step most people miss.

Set-ADUser -Identity msantos -ChangePasswordAtLogon $true

5. Confirm and record

Ask the user to sign in with the temporary password and change it. Record in the ticket who asked, how you verified them, when the reset happened, and that the change-at-logon flag was set. A clear record makes a later question about the account much easier to answer.

What about cloud accounts?

Accounts in Microsoft Entra ID are reset with Microsoft Graph PowerShell or the admin centre, not the Active Directory module. The checks are the same: verify the user, reset, require a change at sign-in, and record it. This lesson covers the on-premises directory only.