Macs work well in Windows corporate environments, but a lot of companies require you to change your password after a period of time (3 months for example).
How do you change your Windows domain password without having to boot a PC?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.
Sign up to join this communityFrom the terminal:
$ smbpasswd -U username -r DOMAIN_CONTROLLER_IP
$ smbpasswd -h
When run by root:
smbpasswd [options] [username]
otherwise:
smbpasswd [options]
options:
-L local mode (must be first option)
-h print this usage message
-s use stdin for password prompt
-c smb.conf file Use the given path to the smb.conf file
-D LEVEL debug level
-r MACHINE remote machine
-U USER remote username
extra options when run by root or in local mode:
-a add user
-d disable user
-e enable user
-i interdomain trust account
-m machine trust account
-n set no password
-W use stdin ldap admin password
-w PASSWORD ldap admin password
-x delete user
-R ORDER name resolve order
smbpasswd
is no longer present in a clean install of Lion.
brew install https://raw.github.com/vertis/homebrew/master/Library/Formula/samba.rb
Oct 24, 2011 at 9:15
samba
package is part of the “default” Homebrew now, so you can just type brew install samba
instead of using that URL.
smbpasswd
doesn't work on macOS 10.12.5, and brew install samba
says "No available formula". Are there other options (not the web portal)?
Another suggestion is to log in to your company's Email Web Portal. Many companies are using MS Exchange which supports changing your password through your web email session. I had this exact issue with users who were not on macs, but instead would never touch a machine that was part of the Active Directory. The webmail/password change interface made this possible and it worked for several hundred users. I must admit the failure messages were quite cryptic and utterly useless. If the password change fails because your new password lacks the complexity, it will likely fail at telling you that. So just be aware of that one limitation.
Piggybacking off of @Havey's answer (requires non-Apple Samba, macports etc.):
I never know/remember what the IP is of the domain controller, so I've created the below script to just bring up smbpasswd
to the old/new password prompt.
#!/bin/bash
USER="joe.bob"
DOMAIN="acme.com"
smbpasswd -U $USER -r `nslookup _ldap._tcp.dc._msdcs.$DOMAIN | awk '{print $2;exit;}'`
You can create a password boot disk with the following password live CDs:
smbpasswd
is no longer present in Lion or above
To bypass this, you can simply use a docker image with the right command lines (from samba-common-bin
package). This will work even for windows or linux. See related Q/A:
smbpasswd command not found on MacOS High Sierra
Using docker image from github.com/GabLeRoux/docker-debian-samba-common-bin:
docker run --rm -it gableroux/debian-samba-common-bin \
bash -c "smbpasswd -U my_activedirectory_username -r 10.x.y.z"
Alternate solution, use kpasswd
:
kpasswd user@REALM