Home

Sometimes, you just can't reset your password.
Sometimes, your company doesn't care why you can't.

Desperate times call for desperate measures;
The following posh script can be run on any domain computer by a domain admin and will reset the password expiration for a given user (the logged-in user by default).
This will simulate the password being reset.
I encapsulated the code in Invoke-Command statements so it will run against a DC, then it forces replication after it's done.

cls
$ls = ($env:LOGONSERVER).TrimStart("\\").ToString() # Get Logon Server
$forestpdc = Invoke-Command -ComputerName $ls -ScriptBlock {Get-ADForest | Select-Object -ExpandProperty RootDomain | Get-ADDomain | Select-Object -Property PDCEmulator}
$localdomainpdc = Invoke-Command -ComputerName $ls -ScriptBlock {Get-ADDomain | Select-Object -Property PDCEmulator}
$sam = $env:UserName.ToString() #change this value to reset another user
$sam2 = Read-Host "User name to reset: [default: $sam]"
if($sam2-eq ""){$sam2=$sam}
$cmd = "Get-ADUser -Filter {SamAccountName -eq ""$sam""}"
$user = Invoke-Command -ComputerName $localdomainpdc.PDCEmulator -ScriptBlock {Get-ADUser -Filter {SamAccountName -eq $Using:sam2}}
Invoke-Command -ComputerName $localdomainpdc.PDCEmulator -ScriptBlock {$uObj = [ADSI]"LDAP://$Using:user"
$uObj.put("pwdLastSet", 0)
$uObj.SetInfo()
$uObj.put("pwdLastSet", -1)
$uObj.SetInfo()}

write-host "Syncing the local domain..."
Invoke-Command -ComputerName $localdomainpdc.PDCEmulator -ScriptBlock {(Get-ADDomainController -Filter *).Name | Foreach-Object {repadmin /syncall $_ (Get-ADDomain).DistinguishedName /e /A | Out-Null}; Start-Sleep 10; Get-ADReplicationPartnerMetadata -Target "$env:userdnsdomain" -Scope Domain | Select-Object Server, LastReplicationSuccess}
if($localdomainpdc.PDCEmulator-ne $forestpdc.PDCEmulator){
write-host "Syncing the forest..."
Invoke-Command -ComputerName $forestpdc.PDCEmulator -ScriptBlock {(Get-ADDomainController -Filter *).Name | Foreach-Object {repadmin /syncall $_ (Get-ADDomain).DistinguishedName /e /A | Out-Null}; Start-Sleep 10; Get-ADReplicationPartnerMetadata -Target "$env:userdnsdomain" -Scope Domain | Select-Object Server, LastReplicationSuccess}
}
$pls = Invoke-Command -ComputerName $localdomainpdc.PDCEmulator -ScriptBlock {(Get-ADUser -Filter {SamAccountName -eq $Using:sam2} -properties PasswordLastSet).PasswordLastSet}
write-host "Sync done..."
write-host "Password last set: $pls"

Tweet