Secure Active Directory Password Reset PowerShell

Secure Active Directory Password Reset PowerShell

Password reset scripts should protect the new credential as carefully as the account itself. Never write a temporary password to the console, transcript, log, CSV, ticket, or pipeline output. Use a separate, approved administrator identity and follow your organization’s identity-verification and audit process before changing an account.

Reset one account interactively

This example prompts for a secure string, confirms the target, and asks PowerShell’s ShouldProcess mechanism before changing the password. Review the target and run it first with -WhatIf.

function Reset-DirectoryUserPassword {
    [CmdletBinding(SupportsShouldProcess)]
    param(
        [Parameter(Mandatory)]
        [string]$Identity
    )

    Import-Module ActiveDirectory -ErrorAction Stop
    $account = Get-ADUser -Identity $Identity -Properties Enabled -ErrorAction Stop

    if (-not $account.Enabled) {
        throw "Account '$($account.SamAccountName)' is disabled. Confirm the request before proceeding."
    }

    if ($PSCmdlet.ShouldProcess($account.SamAccountName, 'Reset Active Directory password')) {
        $newPassword = Read-Host "Enter the approved new password for $($account.SamAccountName)" -AsSecureString
        Set-ADAccountPassword -Identity $account.DistinguishedName -NewPassword $newPassword -Reset -ErrorAction Stop
    }
}

Reset-DirectoryUserPassword -Identity 'jdoe' -WhatIf

After reviewing the -WhatIf output and confirming the account, run the command without -WhatIf. Deliver any temporary credential only through the organization’s approved, identity-verified channel. Do not reuse one temporary password for a group of users.

Require a password change at next sign-in

Use this only when policy and the user’s sign-in method support it. It changes the account flag; it does not reset the password.

Set-ADUser -Identity 'jdoe' -ChangePasswordAtLogon $true -WhatIf

Review the target, then repeat without -WhatIf if approved. For bulk operations, take an explicitly reviewed list of account identifiers and preview every target; avoid Get-ADUser -Filter * followed by a domain-wide change.

Review password status

This read-only report identifies accounts with old password timestamps. It does not expose password values, and password age alone is not proof that an account should be reset. Apply your organization’s current identity policy and investigate service accounts and exceptions separately.

Get-ADUser -Filter * -Properties PasswordLastSet, PasswordExpired, PasswordNeverExpires |
    Select-Object Name, SamAccountName, Enabled, PasswordLastSet,
        PasswordExpired, PasswordNeverExpires

To scope a report, use a known OU with -SearchBase and an appropriate filter. Protect the resulting report because account names and security status can be sensitive operational data.

Operational safeguards

• Confirm the requester’s identity and authorization through the service desk workflow.
• Use least-privilege delegated rights and a dedicated admin account.
• Preview targets with -WhatIf; require a second review for bulk changes.
• Do not place cleartext passwords in script parameters, source control, environment variables, logs, or CSV files.
• Record the change outcome and ticket reference, but never the password itself.
• Test the workflow with a nonproduction account before operational use.

See Microsoft’s references for Set-ADAccountPassword and Set-ADUser.