The “User must change password at next logon” setting forces a user to create a new password the next time they log in. In this guide, I’ll show you how to enable this setting for single and multiple users using PowerShell, AD Pro Toolkit and ADUC.
How to Set User Must Change Password at Next logon with PowerShell
In this example, I’ll use the Set-ADUser PowerShell cmdlet to set the password to change at next logon.
Step 1. Open PowerShell.
Step 2. Run the following command. Change
Set-ADUser -Identity <User> -ChangePasswordAtLogon:$true
If the command is successful it will return to the prompt. In the example below I set the change password at next logon for the user carlton.wehr using the accounts samaccountname.
AD Pro Toolkit: PowerShell Alternative
In this example, I’ll use the AD Pro Toolkit to force a password change at next logon for multiple user accounts. You might need to force multiple users to change their password due to a security incident or policy requirements.
Step 1. Create a CSV with a list of users
You can export all users samAccountName with the command below. You can also use the export AD users tool to export all users or specific users to a CSV file.
get-aduser -filter * | select samaccountname | export-csv c:\it\all-users.csv
You just need a csv file with a list of users sAMAccountName (logon name) like below.
Step 2. Run Bulk User Modification Tool
Click on “Update Options” and select “True” for change password at next logon.
Next, select your csv file and click run.
Download AD Pro Toolkit and see how easy it is to manage AD user accounts.
Change Password at Next Logon Status Report
The toolkit includes hundreds of Active Directory Reports on users, passwords, logons, groups and much more.
Below is an example of how to get a list of users that have change password at next logon enabled.
Browse to User Password Reports > Change Password at Next Logon
Click run to generate the report.
You can export this report to csv, excel or pdf.
Download AD Pro Toolkit and try these reports for free.
Force User to Change Password at Next Logon using ADUC
You can manually check a single account with the Active Directory Users and Computers tool.
Open a user account and click the “Account” Tab. Under the account options you will see the “User must change password at next logon” option. If it is checked then it is enabled.
User Must Change Password at Next Logon Attribute
The “User must change password at next logon” setting is controlled by the pwdLastSet attribute in Active Directory. When this attribute is set to 0, the user is forced to change their password the next time they log in. When the user changes their password, pwdLastSet updates to the current timestamp automatically.
You can check this attribute with PowerShell:
Get-ADUser -Properties PasswordLastSet -Filter "PasswordLastSet -eq '0'" | select name, PasswordLastSet
In the screenshot below you can see the PasswordlastSet value is blank.
With the AD Pro Toolkit this is not an issue, and you can easily create a list of users that has change password at next logon enabled.
