27

Macs work well in Windows corporate environments, but a lot of companies require you to change your password after a period of time (3 months for example).

How do you change your Windows domain password without having to boot a PC?

Improve this question
0
22

From the terminal:

$ smbpasswd -U username -r DOMAIN_CONTROLLER_IP

$ smbpasswd -h
When run by root:
    smbpasswd [options] [username]
otherwise:
    smbpasswd [options]

options:
  -L                   local mode (must be first option)
  -h                   print this usage message
  -s                   use stdin for password prompt
  -c smb.conf file     Use the given path to the smb.conf file
  -D LEVEL             debug level
  -r MACHINE           remote machine
  -U USER              remote username
extra options when run by root or in local mode:
  -a                   add user
  -d                   disable user
  -e                   enable user
  -i                   interdomain trust account
  -m                   machine trust account
  -n                   set no password
  -W                   use stdin ldap admin password
  -w PASSWORD          ldap admin password
  -x                   delete user
  -R ORDER             name resolve order
Improve this answer
9
  • 9
    Unfortunately smbpasswd is no longer present in a clean install of Lion. – Nate Aug 3 '11 at 18:15
  • 3
    If you're running Homebrew, you may want to try running brew install https://raw.github.com/vertis/homebrew/master/Library/Formula/samba.rb – Pål Brattberg Oct 24 '11 at 9:15
  • 5
    The samba package is part of the “default” Homebrew now, so you can just type brew install samba instead of using that URL. – bdesham Nov 24 '14 at 17:28
  • 3
    smbpasswd doesn't work on macOS 10.12.5, and brew install samba says "No available formula". Are there other options (not the web portal)? – Paaske Jun 6 '17 at 8:29
  • 1
    If you are using macOS High Sierra (10.13.4) or Sierra you can install samba using macports macports.org/install.php, then you can use port command: port install samba3 and after that you can follow instructions described above, smbpasswd should be available. – neosergio May 4 '18 at 16:07
9

Another suggestion is to log in to your company's Email Web Portal. Many companies are using MS Exchange which supports changing your password through your web email session. I had this exact issue with users who were not on macs, but instead would never touch a machine that was part of the Active Directory. The webmail/password change interface made this possible and it worked for several hundred users. I must admit the failure messages were quite cryptic and utterly useless. If the password change fails because your new password lacks the complexity, it will likely fail at telling you that. So just be aware of that one limitation.

Improve this answer
3
  • Ah, I should have mentioned that I would have done that if it worked at my company. It always says it works and does nothing. Good suggestion. – Harvey Aug 10 '09 at 16:26
  • The cryptic messages definately do not accurately describe whether the password change was succeful. The biggest problems I saw were related to passwords that did not meet the length, Uppercase/Lowercase, number and symbol within the password itself. You have to choose a very complex password for this to work correctly. – Axxmasterr Aug 10 '09 at 16:51
  • I should have added that if your password change fails because of rules, the command-line approach will give you some indication of failure while (in my experience) the web method just silently fails. However, always try the web portal method first, if available. – Harvey Jan 12 '11 at 22:52
3

Piggybacking off of @Havey's answer (requires non-Apple Samba, macports etc.):

I never know/remember what the IP is of the domain controller, so I've created the below script to just bring up smbpasswd to the old/new password prompt.

#!/bin/bash

USER="joe.bob"                                             
DOMAIN="acme.com"

smbpasswd -U $USER -r `nslookup _ldap._tcp.dc._msdcs.$DOMAIN | awk '{print $2;exit;}'`
Improve this answer
1

You can create a password boot disk with the following password live CDs:

  1. Ophcrack live CD
  2. Offline NT Password and Registry editor
  3. Windows Password reset for Mac
Improve this answer
0

smbpasswd is no longer present in Lion or above

To bypass this, you can simply use a docker image with the right command lines (from samba-common-bin package). This will work even for windows or linux. See related Q/A: smbpasswd command not found on MacOS High Sierra

Using docker image from github.com/GabLeRoux/docker-debian-samba-common-bin:

docker run --rm -it gableroux/debian-samba-common-bin \
  bash -c "smbpasswd -U my_activedirectory_username -r 10.x.y.z"

Alternate solution, use kpasswd:

kpasswd user@REALM
Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.