SERVER-008 · Script
Reset Account Password
Resets passwords for directory or local accounts to new random passwords, saved to a protected file.
What it does
Resets one or more accounts, by name or from a CSV file with an Identity column. Directory domain accounts (default)
- Local: local accounts on the computer the script runs on
Each account gets its own random password. Passwords are saved to a file in the Runbookia Secure folder that only SYSTEM and Administrators can read, and are never written to the log. Preview mode (default) checks that each account exists and changes nothing. Optionally unlocks directory accounts and requires a new password at next sign-in.
Requirements
Windows PowerShell 5.1. Directory scope: the ActiveDirectory module (RSAT) and the Reset Password right on the accounts.
How to run it
- Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
- Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
- Script type: PowerShell 5.1, 64-bit
- User interaction: none; the script never prompts
- Timeout: 30 minutes for large directories or many servers
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Preview (default) or Apply. | Preview, Apply | Preview |
| Identity | Account names to reset. | (none) | |
| CsvPath | CSV file with an Identity column. Used when -Identity is empty. | ||
| Scope | Directory (default) or Local. | Directory, Local | Directory |
| PasswordLength | Length of each new password. Default: 16. | 16 | |
| ChangeAtSignIn | Yes (default) makes directory users set their own password at next sign-in. Ignored for local accounts. | Yes, No | Yes |
| Unlock | Also unlock directory accounts that are locked out. | False | |
| Server | Optional domain controller to use for every change. |
Exit codes
- 0 = All accounts reset (or would be, in Preview)
- 1 = Some accounts were not found or could not be reset
- 2 = Script error (see log)
Testing steps
- Run it first with the mode set to Preview on one test OU, test account or test server. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Preview mode changes nothing. Old passwords cannot be restored. If a reset went to the wrong account, reset it again and give the user the new password from the Secure folder file.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |