PowerShell Reset AD Password and Unlock Account

A helpdesk ticket for a locked account or forgotten password should take seconds, not five minutes — and it should never require the technician to log into a GUI. PowerShell reset Active Directory password and unlock workflows with Set-ADAccountPassword and Unlock-ADAccount are the core tools every helpdesk professional and sysadmin needs memorized. This post covers password resets, forced change at next login, account unlock, lock status checks, and a complete logging pattern for audit trails.

Reset a User Password

Use Set-ADAccountPassword to reset a password. The new password must be a SecureString. Use -Reset to replace the existing password without knowing the current one (admin reset scenario).

# Interactive: prompt for new password
Set-ADAccountPassword -Identity "jsmith" -Reset -NewPassword (
    Read-Host -Prompt "New password for jsmith" -AsSecureString
)

# Scripted: set a known temporary password
$tempPassword = ConvertTo-SecureString "Temp2026#Reset!" -AsPlainText -Force
Set-ADAccountPassword -Identity "jsmith" -Reset -NewPassword $tempPassword

Write-Output "Password reset for jsmith."

Force Password Change at Next Login

After resetting a password to a temporary value, require the user to set a new one on next login using Set-ADUser with -ChangePasswordAtLogon $true.

# Reset password AND require change on next login
$tempPassword = ConvertTo-SecureString "Temp2026#Reset!" -AsPlainText -Force
Set-ADAccountPassword -Identity "jsmith" -Reset -NewPassword $tempPassword
Set-ADUser -Identity "jsmith" -ChangePasswordAtLogon $true

Write-Output "Password reset. User must change on next login."

Unlock a Locked Account

Account lockouts happen after too many failed login attempts. Unlock-ADAccount clears the lockout without changing the password — the user can log in again with their existing credentials.

# Unlock a single account
Unlock-ADAccount -Identity "jsmith"
Write-Output "jsmith unlocked."

# Combined: unlock and verify
Unlock-ADAccount -Identity "jsmith"
$user = Get-ADUser -Identity "jsmith" -Properties LockedOut
Write-Output "$($user.Name) locked: $($user.LockedOut)"

Check Account Lock Status

Before unlocking, check whether the account is actually locked out. The LockedOut property is not returned by default — always request it with -Properties LockedOut.

# Check lockout status for a specific user
Get-ADUser -Identity "jsmith" -Properties LockedOut, BadLogonCount, LastBadPasswordAttempt |
    Select-Object Name, Enabled, LockedOut, BadLogonCount, LastBadPasswordAttempt

Name        Enabled  LockedOut  BadLogonCount  LastBadPasswordAttempt
----        -------  ---------  -------------  ----------------------
John Smith  True     True       5              5/4/2026 8:42:00 AM

# Find all currently locked out users in the domain
Search-ADAccount -LockedOut -UsersOnly |
    Select-Object Name, SamAccountName, LastLogonDate

Bulk Unlock Multiple Accounts

During a major incident — widespread incorrect password cache, a password sync issue — you may need to unlock dozens of accounts simultaneously.

# Unlock all locked accounts in the domain
$lockedUsers = Search-ADAccount -LockedOut -UsersOnly
Write-Output "Found $($lockedUsers.Count) locked accounts."

foreach ($user in $lockedUsers) {
    Unlock-ADAccount -Identity $user.SamAccountName
    Write-Output "Unlocked: $($user.SamAccountName)"
}

Log Reset Activity to File

For compliance and audit purposes, every password reset should be logged with a timestamp, the performing admin’s identity, and the target account. Write a simple wrapper function that combines the reset with logging.

function Reset-UserPassword {
    param(
        [Parameter(Mandatory)]
        [string]$SamAccountName,
        [Parameter(Mandatory)]
        [SecureString]$NewPassword
    )

    $logFile = "C:\Logs\password-resets.log"
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $admin = $env:USERNAME

    try {
        Set-ADAccountPassword -Identity $SamAccountName -Reset -NewPassword $NewPassword -ErrorAction Stop
        Set-ADUser -Identity $SamAccountName -ChangePasswordAtLogon $true
        "$timestamp | RESET | Admin: $admin | User: $SamAccountName | SUCCESS" | Add-Content -Path $logFile
        Write-Output "Password reset for $SamAccountName logged."
    } catch {
        "$timestamp | RESET | Admin: $admin | User: $SamAccountName | FAILED: $_" | Add-Content -Path $logFile
        Write-Error "Reset failed for $SamAccountName: $_"
    }
}

# Usage
$pwd = Read-Host -Prompt "New temp password" -AsSecureString
Reset-UserPassword -SamAccountName "jsmith" -NewPassword $pwd

Common Errors and Fixes

• Requires Domain Admin or delegated reset rights: Set-ADAccountPassword requires the “Reset Password” permission on the target account. Domain Admins have this by default, but helpdesk accounts need it delegated for the relevant OU. Use the Delegation of Control Wizard in ADUC to grant helpdesk groups the “Reset user passwords and force password change at next logon” permission scoped to the appropriate OUs.
• SecureString required for password parameter: Passing a plain text string to -NewPassword throws a type error. Always convert first with ConvertTo-SecureString "password" -AsPlainText -Force, or prompt with Read-Host -AsSecureString. In production automation (CI/CD pipelines), retrieve secrets from a secrets manager rather than embedding them as plain text.

Related Cmdlets / See Also

• PowerShell Active Directory: Get-ADUser Examples
• PowerShell Active Directory User Management: Create and Modify

Wrapping Up

Password resets and account unlocks are the highest-volume helpdesk tasks — wrapping them in a logged function like Reset-UserPassword above gives you both speed and an audit trail. As a next step, expose this function through a simple HTML form with PowerShell Web Access or a Teams bot, so helpdesk staff can reset passwords without needing a PowerShell prompt at all.