📋 Set-ADAccountPassword Cheat Sheet: Syntax, Examples, Bulk Operations

The Set-ADAccountPassword cmdlet is the primary PowerShell tool for managing Active Directory user passwords. Unlike New-ADUser -AccountPassword, which only works during user creation, Set-ADAccountPassword operates on existing accounts — making it essential for password resets, offboarding, and incident response.

This cheat sheet covers every parameter, every common scenario, and the edge cases that trip up even experienced IT admins.

Basic Syntax

Set-ADAccountPassword [-Identity] <ADUser> [-NewPassword] <SecureString> [-Reset] [-PassThru] [-Server] [-Credential] [-WhatIf] [-Confirm] [<CommonParameters>]

Quick Reference

Parameter Reference

Secure String Conversion

The trickiest part of using Set-ADAccountPassword is creating the SecureString. These three methods all work but have different use cases:

Bulk Operations

Reset All Users in an OU

Import-Module ActiveDirectory
$ou = "OU=Sales,DC=contoso,DC=com"
$generated = Import-Csv "passwords.csv"

$users = Get-ADUser -Filter * -SearchBase $ou
$i = 0
$users | ForEach-Object {
    $secPwd = ConvertTo-SecureString $generated[$i].password -AsPlainText -Force
    Set-ADAccountPassword -Identity $_.SamAccountName -NewPassword $secPwd -Reset
    Set-ADUser -Identity $_.SamAccountName -ChangePasswordAtLogon $true
    $i++
}

Reset with Different Passwords Per User (From Generator CSV)

# CSV from generator: index,password
# Merge with user list
$passwords = Import-Csv "generated_passwords.csv"
$userList = @("jsmith", "agarcia", "bnguyen", "mwilliams")

for ($i = 0; $i -lt $userList.Count; $i++) {
    $secPwd = ConvertTo-SecureString $passwords[$i].password -AsPlainText -Force
    Set-ADAccountPassword -Identity $userList[$i] -NewPassword $secPwd -Reset
    Set-ADUser -Identity $userList[$i] -ChangePasswordAtLogon $true
}

Reset with Verification

$users = Import-Csv "reset.csv"
$results = @()

foreach ($user in $users) {
    $secPwd = ConvertTo-SecureString $user.password -AsPlainText -Force
    try {
        Set-ADAccountPassword -Identity $user.sam -NewPassword $secPwd -Reset -ErrorAction Stop
        Set-ADUser -Identity $user.sam -ChangePasswordAtLogon $true
        $results += [PSCustomObject]@{User=$user.sam; Status="Success"; Time=Get-Date}
    }
    catch {
        $results += [PSCustomObject]@{User=$user.sam; Status="Failed: $($_.Exception.Message)"; Time=Get-Date}
    }
}

$results | Export-Csv "reset_results.csv" -NoTypeInformation
$results | Group-Object Status | Select-Object Name, Count

Common Errors and Fixes

Pipeline Best Practices

1. Generate first, reset second. Use the Instant Password Generator to create all passwords in one batch. Download the CSV, merge with your user list, then run Set-ADAccountPassword.
2. Always use -WhatIf on the first run. Pipe your user list through Set-ADAccountPassword -WhatIf to verify the cmdlet resolves every identity correctly before committing changes.
3. Log every reset. At minimum, capture which users were reset, at what time, and whether it succeeded. Use the verification script above.
4. Delete the CSV after. The generated passwords are plaintext in your CSV. Once the reset completes successfully, delete the file or store it encrypted.
5. Set a post-reset expiry. The template uses -ChangePasswordAtLogon $true, which effectively expires the generated password immediately. For service accounts, use a scheduled rotation instead — see the enterprise automation guide.

AD Password Management Series

• 📋 New-ADUser Bulk Creation with Generated Passwords — create users from scratch with unique passwords
• 🔁 Reset AD Passwords in Bulk from CSV with Force-Change-at-Logon — the companion guide for existing users
• 📋 Set-ADAccountPassword Cheat Sheet — you're here
• 🗂️ Bulk Password Generation for Windows AD — overview of the complete workflow

For teams managing passwords at scale, a shared credential manager keeps everything auditable and secure. NordPass Business integrates with Active Directory and provides access groups, activity logs, and breach monitoring across the organisation.

Disclosure: If you purchase through the NordPass link above, we may earn a commission at no extra cost to you. All affiliate links are marked with "sponsored" per FTC and ASA guidelines.