Library / Windows Server and AD

SERVER-020 · Script

Deliver Password Resets Securely

Resets directory passwords and hands each one to a named person through a locked-down file that expires.

Version 1.0.0Language PowerShellUpdated November 2026

What it does

For each request (an account to reset and the person who should receive the new password), the script: 1. Sets a new random password and requires the user to change it at next sign-in 2. Writes a small text file to -DropPath, named for the account and the expiry time 3. Locks the file so only the recipient can open it (plus SYSTEM, Administrators and the account running the script, so Cleanup can remove it) The password never appears in the log or report. Nothing is sent by email or to any outside service. Cleanup mode deletes files whose expiry time has passed; schedule it to run every hour. Preview mode (default) checks every account and recipient and changes nothing.

Requests come from -Identity with one -Recipient, or from a CSV with Identity and Recipient columns.

Requirements

Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). The Reset Password right on the accounts, and rights to create files and set permissions in -DropPath.

How to run it

  • Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
  • Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
  • Script type: PowerShell 5.1, 64-bit
  • User interaction: none; the script never prompts
  • Timeout: 30 minutes for large directories or many servers

Settings

NameWhat it doesOptionsDefault
ModePreview (default), Apply or Cleanup.Preview, Apply, CleanupPreview
IdentityAccounts to reset.(none)
RecipientAccount (DOMAIN\name or sign-in name) that may read the files, for example a teacher or office manager.
CsvPathCSV with Identity and Recipient columns. Used when -Identity is empty.
DropPathFolder or share where files are written, for example \\fs01\ResetDrop. Must already exist.
ExpireHoursHours before a file is removed by Cleanup. Default: 24.24
PasswordLengthLength of each new password. Default: 14.14
ServerOptional domain controller to use for every change.

Exit codes

  • 0 = All requests done (or would be, in Preview), or cleanup finished
  • 1 = Some requests failed
  • 2 = Script error (see log)

Testing steps

  1. Run it first with the mode set to Preview on one test OU, test account or test server. Nothing is changed in that mode.
  2. Read the log and confirm the planned changes are what you expect.
  3. Run your chosen settings on the same test target and confirm the result.
  4. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
  5. Roll out to a small group next, then everyone.

Rollback steps

Preview and Cleanup change no accounts. Old passwords cannot be restored. If a file went to the wrong person, delete it, then run the script again for that account with the right recipient.

Version and change log

VersionDateChanges
1.0.0November 2026First release.