Skip to main content

​
Overview

Change a user’s password using the Kerberos password change protocol. This command leverages the Kerberos change password service to modify user passwords when current credentials are known.

​
Syntax

​
Required Parameters

​
user
string
required
Target username for password change
​
current
string
required
Current password for the user
​
new
string
required
New password to set for the user

​
Optional Parameters

​
domain
string
Target domain (default: current domain)
​
dc
string
Domain controller to target

​
Examples

​
Use Cases

Password Rotation:
  • Routine password changes for compromised accounts
  • Service account credential rotation
  • Security policy compliance
  • Credential lifecycle management
Operational Security:
  • Change passwords after compromise detection
  • Rotate service account credentials
  • Maintain access while changing credentials
  • Support long-term operations

​
Technical Requirements

Current Credentials:
  • Valid current password required
  • User must have password change permissions
  • Account must not be locked or disabled
  • Domain connectivity required
Service Requirements:
  • Kerberos password change service available
  • Domain controller accessibility
  • Proper network connectivity
  • No blocking security policies

​
Integration Workflows

Complete Workflow:
  • asktgt - Use new password for TGT requests
  • hash - Generate hash from new password