Password resets and account lockouts are the most common requests an IT administrator handles. A user forgets a password, types it wrong too many times, or comes back from leave to a locked account. Active Directory makes both tasks quick, but doing them correctly and finding out why accounts keep locking is what separates a quick fix from a repeating problem. This guide covers the graphical way, the PowerShell way and how to trace a lockout.

Before you start

You need permission to reset passwords, for example Domain Admin or a delegated help desk role.
Use the tool on a domain controller or on your PC with RSAT (Remote Server Administration Tools) installed.
Verify the person’s identity before you reset anything. A reset request by phone or chat is a common way attackers take over accounts.

Method 1: Reset a password with Active Directory Users and Computers

Press Win + R, type dsa.msc and press Enter. This opens Active Directory Users and Computers.
Find the user. Use the Find option or browse to the correct organizational unit.
Right-click the user and select Reset Password.
Type the new temporary password twice. Follow your password policy for length and complexity.
Tick User must change password at next logon so only the user knows the final password.
If the account is locked, also tick Unlock the user’s account.
Click OK. Windows confirms that the password has been changed.

Method 2: Unlock an account

If the user can remember the password but the account is locked, you only need to unlock it.

Double-click the user to open the properties.
Go to the Account tab.
Tick Unlock account. This account is currently locked out on this Active Directory Domain Controller.
Click Apply and OK.

The user can try again immediately.

Method 3: Use PowerShell

PowerShell is faster when you handle many requests. Open PowerShell as administrator on a PC with the ActiveDirectory module.

Reset a password (the command prompts you for the new password):

Set-ADAccountPassword -Identity jsmith -Reset -NewPassword (Read-Host -AsSecureString)

Force a change at next logon:

Set-ADUser -Identity jsmith -ChangePasswordAtLogon $true

Unlock the account:

Unlock-ADAccount -Identity jsmith

List all locked accounts in the domain:

Search-ADAccount -LockedOut | Select Name, SamAccountName

Replace jsmith with the user’s logon name.

Why do accounts keep getting locked?

If the same account is locked again and again, resetting it will not solve the problem. A device or program somewhere is still using the old password. Typical causes:

A phone or tablet with email or Wi-Fi still saved with the old password.
A mapped network drive or saved credential in Windows Credential Manager.
A second PC where the user is still logged in.
A service, scheduled task or application that runs under that user account.
A remote desktop session left open on a server.

How to trace the source of a lockout

Find the domain controller that holds the PDC emulator role by running Get-ADDomain | Select PDCEmulator.
On that server open Event Viewer, Windows Logs, Security.
Filter for Event ID 4740. This event is logged each time an account is locked.
Open the event for the user and read the Caller Computer Name. That is the machine sending the wrong password.
Go to that machine and remove the old saved credentials, disconnect old drives or update the service password.

Good practices for password resets

Always verify identity before a reset.
Always require the user to change the password at next logon.
Never send the temporary password in a public chat. Share it in a private way.
Delegate only the needed rights to help desk staff using the delegation wizard, instead of giving them full admin access.
Check your lockout policy in Group Policy. Very low thresholds cause many lockouts, while very high ones weaken security.
Remind users to update the password on every device after a change.

FAQ

Can I reset a password from my own PC and not the server? Yes. Install RSAT on your Windows PC and use Active Directory Users and Computers or PowerShell with a domain account that has the rights.

Why does the unlock option not appear for a user? The account may not be locked on the domain controller you are connected to. Refresh the view or connect to the PDC emulator and check again.

The user says the new password does not work. Why? The change may not have replicated to all domain controllers yet, or the password does not meet the policy, or the PC is using cached credentials. Wait a few minutes, make sure the PC is on the network and try again.

What is the difference between a reset and a change? A change needs the old password and is done by the user. A reset is done by an administrator without knowing the old password.

Related reading: The Network Path Was Not Found: Domain Join Error Fix | How to Automate Windows Server Backup | IP Address Conflict in the Office: How to Find and Fix It

How to Reset a Password and Unlock an Account in Active Directory