Why password reset via cmdlet doesn't honour Password history policy?

Question

When we reset a password via cmdlet, it doesn't honor the Password history policy but the change password does. Why?
We implemented Self Service Password Reset for AD, but even if History policy is enabled at the AD level, a user can re-use older passwords while resetting password via the self service. Whereas this is not the case with Change Password, there it always fails.

Answer 1

Are you allowing the script to run as a domain admin, or is the script being forced to "Run as administrator"? If not, the user would have to provide the old password, too. That would expose the old password to the script and allow the script to pose as that user for a period of time (one hour, if I recall correctly).

https://serverfault.com/questions/728591/why-are-active-directory-password-resets-ignoring-the-password-history-count-rul

You could try using Fine Grained Password Policy, too.