Powershell script is not resetting user password

Question

Powershell script is not resetting user password

T Crha 396

Hello everyone,

I am wondering if there is someone here able to help me with a strange thing I came across while executing a PS script that creates AD users in our organization.

The part I need to help with in particular is the one where newcomers password is being set up. Within the script, it looks like this:

$username_new = <samaccountname of the newcomer>
$random = -join ((0..9) | Get-Random -Count 4)
$ADpwdtext = "text1" + $random + "text2"
$dc = <domain controller>
#$sessionAD = New-PSSession -ComputerName $dc -Credential $cred

Set-ADAccountPassword -Identity $username_new -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "$ADpwdtext" -Force) -Server $dc -Confirm:$True;
Set-ADUser -Identity $username_new -ChangePasswordAtLogon:$true -Server $dc -Confirm:$True;
get-aduser $username_new -Properties * | select password*

Write-Host "New password is:" -ForegroundColor Yellow
Write-Host "$ADpwdtext`n`n" -ForegroundColor Black -BackgroundColor Yellow
#endregion

But when I run this part of the script, it doesnt do anything - neither does it set the password, nor does it set the password to be reset upon next logon. When I check users password properties after that, it looks like this:

get-aduser <samaccountname of the newcomer> -Properties * | select password*

PasswordExpired PasswordLastSet PasswordNeverExpires PasswordNotRequired

   True                                False               False

When I run those Set cmdlets separately, they work without any problems.

Any clues why this is happening?

Thanks everyone!

Tomas

Rich Matheisen 47,901 Reputation points

2023-03-01T16:28:29.1833333+00:00

The first thing that comes to mind is that the Get-ADUser cmdlet in your script isn't using the -Server $dc as the Set-ADAccountPassword and Set-ADUser cmdlets. The results may be from a DC that has not yet received modifications to the user. If that's the case, it probably works when you run the commands separately because you're looking at an unspecified DC that's already received the replicated changes (because you're not as fast as the script!).
T Crha 396 Reputation points

2023-03-02T12:58:29.5366667+00:00

Hello, many thanks for your answer. Unfortunately, this is not working. The behavior changed a bit though. Now when I run the whole sequence I specified above, password gets reset. But the script contains many other tasks, like renaming user, assigning to groups, modifying attributes, creating mailbox etc - this password reset comes as a last thing, and when the whole script runs, password is not being reset. I doesnt make sense to me why it does work only when ran separately.

Any comments are highly appreciated!

Thank you,

Tomas
Rich Matheisen 47,901 Reputation points

2023-03-02T19:48:49.63+00:00

The answer provided you with a working correction to the stated problem within the confines of the code you posted. You've verified that the correction worked.

You've now expanded the scope of your question to include code you haven't disclosed. I'm not going to guess at where the problem might be in that code.

Run your code using a debugger. Set a breakpoint before the code that changes the password and when you reach the breakpoint (which maybe you never get to!) verify the variables used have the values you expect.

If you need further assistance, post a new question with the supporting code.