Change a Windows password with net user, PowerShell or Ctrl+Alt+End

Short answer: open Command Prompt as Administrator and run net user USERNAME *. Windows asks for the new password twice without showing it and answers The command completed successfully. net user USERNAME NewPassword also works, but leaves the password on screen and in your command history. In PowerShell, Set-LocalUser with Read-Host -AsSecureString does the same.

C:\Windows\system32> net user Administrator *
Type a password for the user:
Retype the password to confirm:
The command completed successfully.

This guide is written from Microsoft Learn’s net user reference (last updated August 2025), the Set-LocalUser reference for Windows PowerShell 5.1 and the password policy pages, as of October 2026. It applies to Windows Server 2016 to 2025 as well as Windows 10 and 11, and it covers local accounts first, then domain accounts, then the part that matters most on a remote server: not locking yourself out.

Change a password with net user

rem list the local accounts
net user
rem new password for alice: asked twice, never shown
net user alice *
rem quote names that contain spaces
net user "John Smith" *
rem check the result
net user alice

• It needs an elevated prompt. Setting a password with net user is a reset: Windows does not ask for the old one, so only administrators may do it. In a window that is not elevated the answer is System error 5 has occurred. Access is denied. Right-click Command Prompt or PowerShell and choose Run as administrator.
• The asterisk is what makes it safe. Per Microsoft Learn, * produces a prompt and the password is not displayed while you type it. Nothing is echoed, not even dots, so type carefully; the confirmation catches typos.
• Limits: user names have up to 20 characters, passwords up to 127, and the password must still meet the minimum length and the other policy rules (below).

net user alice without a password shows the account afterwards. The lines to read are Password last set (should be now), Password expires, Account active and Local Group Memberships.

Why not net user NAME NewPassword?

net user alice S3cret-Pass sets the password in one line, and that convenience is the problem. Three things go wrong with it:

• It is visible. On your screen, in a screenshot or screen recording, and to anyone watching a shared session.
• It is stored. cmd keeps it in the window’s history (press F7). PowerShell is worse: its PSReadLine module writes the commands you type to a history file on disk, which outlives the session and the reboot.
• It may not be the password you think. cmd treats & | < > ^ % specially, PowerShell treats $, backticks, semicolons and quotes specially. Typed in PowerShell, net user bob Pa$$w0rd sets a different password, because $$ is an automatic variable that PowerShell expands first. You then cannot log in with what you typed.

If you already did it, find and delete the line from PowerShell’s history file:

(Get-PSReadLineOption).HistorySavePath                 # where the history file is
Select-String -Path (Get-PSReadLineOption).HistorySavePath -Pattern 'net user'
notepad (Get-PSReadLineOption).HistorySavePath          # remove the line, save

Change a password in PowerShell with Set-LocalUser

$pw = Read-Host -AsSecureString "New password"
Set-LocalUser -Name "alice" -Password $pw

# check the result
Get-LocalUser -Name "alice" | Select-Object Name, Enabled, PasswordLastSet, PasswordExpires

Read-Host -AsSecureString shows asterisks while you type and hands the password over as a SecureString, so it never appears in the history. This is Microsoft’s own example for the cmdlet. The same cmdlet changes the other password settings: -PasswordNeverExpires $true, -UserMayChangePassword $false and -AccountExpires.

Set-LocalUser belongs to the Microsoft.PowerShell.LocalAccounts module of Windows PowerShell 5.1, which every current Windows Server has. Learn notes that the module is not available in 32-bit PowerShell on a 64-bit system, so if the cmdlet “is not recognized”, check that you did not open Windows PowerShell (x86). In scripts, avoid ConvertTo-SecureString "..." -AsPlainText -Force with a literal password: it puts the password in the script file, which is the history problem again.

Change your own password inside an RDP session

A user who is not an administrator cannot use net user on their own account, because that is a reset. The normal way to change your own password is the Windows Security screen: in a Remote Desktop session press Ctrl+Alt+End (Ctrl+Alt+Del goes to your local computer), choose Change a password, and enter the old password and the new one twice. The guide to Ctrl+Alt+Del in RDP has the Mac and laptop keys, and what to do when the password has already expired.

Afterwards, update everything that stored the old password, or it keeps failing:

• Saved credentials in Remote Desktop Connection, Windows App or your password manager.
• Scheduled tasks set to run as that account with a stored password. Microsoft’s schtasks reference says it plainly: if the password changes and the task keeps the old one, the task won’t run.
• Services that log on as that account.

# services that log on as a named account instead of a built-in one
Get-CimInstance Win32_Service |
    Where-Object { $_.StartName -and $_.StartName -notmatch 'LocalSystem|LocalService|NetworkService|NT SERVICE' } |
    Select-Object Name, StartName

# scheduled tasks that run as a named account
Get-ScheduledTask |
    Where-Object { $_.Principal.UserId -and $_.Principal.UserId -notmatch 'SYSTEM|LOCAL SERVICE|NETWORK SERVICE' } |
    Select-Object TaskName, @{n='RunAs'; e={$_.Principal.UserId}}

“The password does not meet the password policy requirements”

The password does not meet the password policy requirements. Check the minimum
password length, password complexity and password history requirements.

More help is available by typing NET HELPMSG 2245.

That is net user’s answer. Set-LocalUser and the Change a password screen say Unable to update the password. The value provided for the new password does not meet the length, complexity, or history requirements of the domain. Both mean the same: the password breaks one of three rules.

Microsoft Learn spells out the complexity rule. The password may not contain the account name (when that is three characters or more) or any part of the full name of three characters or more, and it needs characters from three of these groups: uppercase letters, lowercase letters, digits, symbols, and other Unicode letters. Currency symbols such as € and £ do not count as symbols. To read all three settings at once:

net accounts
secedit /export /cfg %TEMP%\secpol.cfg >nul
findstr /i "MinimumPasswordLength PasswordComplexity PasswordHistorySize" %TEMP%\secpol.cfg
del %TEMP%\secpol.cfg

PasswordComplexity = 1 means the rule is on. The settings live in secpol.msc under Account Policies, Password Policy; on a domain member the domain’s policy overrides them. Do not weaken the policy to make a short password fit. Make the password longer: four or five random words with a capital letter and a digit pass the complexity rule and are far easier to type than 16 random symbols. One more rule, Minimum password age, only affects users changing their own password: if it is set to one day, a second change on the same day fails with the same message.

Domain accounts: net user /domain

net user jdoe * /domain

/domain sends the change to a domain controller of the computer’s primary domain instead of the local account database. You need rights to reset passwords in that domain, and the domain’s password policy applies, which Microsoft ships with complexity switched on. With the Active Directory PowerShell module (on domain controllers, or with the RSAT tools) the equivalent is:

Set-ADAccountPassword -Identity jdoe -Reset -NewPassword (Read-Host -AsSecureString "New password")
Set-ADUser -Identity jdoe -ChangePasswordAtLogon $true      # make the user pick their own

Don’t lock yourself out of Administrator on a VPS

On a server you reach only over the network, a password change is one of the few routine tasks that can leave you outside. These steps keep it boring:

1. 1Keep the current session open

   Change the password, then open a second RDP connection with the new one. Close the first only when the second works.

2. 2Pick a password you can type into a console

   If RDP ever fails, you may have to type the password into a browser console whose keyboard layout differs from yours. Digits and most letters survive that, but y and z swap between English and German layouts, and symbols such as @ and " or accented letters move around. Length gives you more security than exotic symbols.

3. 3Update saved credentials right away

   A client that keeps retrying the old password can trip the account lockout policy and lock the account for everyone; the lockout settings are explained in securing a Windows RDP server.

4. 4Do not disable or rename Administrator in passing

   net user Administrator /active:no with no second administrator account is a lockout. Create and test the second account first (adding users is shown in multiple RDP sessions on Windows Server). Renaming the account can break a panel’s password reset that targets the name Administrator.

The same jobs on Linux

If you look after Linux servers too, the guide to listing users on Linux explains which accounts can log in at all, and ends with the Windows commands for the same audit.

Frequently asked