Force Password Change on Windows 10: 6 Ways

To force a password change on Windows 10, you can set an account to require a new password at next sign-in using the Ctrl+Alt+Delete option, or enforce a maximum password age via Local Security Policy or Group Policy. For Microsoft accounts, you can remotely sign out all devices and reset the password online, which forces the user to create a new one. This article covers six practical methods for both local and Microsoft accounts, including command-line and PowerShell alternatives.

Why Force a Password Change?

Forcing a password change is a common security practice after a suspected breach, when an employee leaves, or when a shared account has been exposed. It ensures that any previously known credentials become useless. On Windows 10, the method differs depending on whether the account is a local account (stored only on the PC) or a Microsoft account (linked to an email address). Local accounts are managed entirely on the device, while Microsoft accounts require online actions or policy settings that sync across devices.

Method 1: Using Ctrl+Alt+Delete (Local Accounts)

This is the quickest way to force a change for a local user who is currently logged in or at the lock screen.

1. Press Ctrl+Alt+Delete on the target user’s keyboard.
2. Select Change a password.
3. Enter the current password, then the new password twice.
4. Click the arrow or press Enter. The password is changed immediately.

This method only works if you know the current password. If the user is locked out, you need an administrator account to reset it, which is covered below.

Method 2: User Accounts Dialog (Administrator Required)

For a local account, an administrator can force a password change at next sign-in without knowing the current password.

1. Press Win + R, type netplwiz, and press Enter.
2. Select the user account, then click Reset Password.
3. Enter a temporary password (or leave blank) and confirm.
4. Uncheck Users must enter a user name and password to use this computer? No—that’s a different setting. Instead, after resetting, the user will be prompted to change it only if you also set the “User must change password at next logon” option. That option is not in netplwiz directly—use the Local Security Policy method below.

Actually, the netplwiz dialog does not have a “must change at next logon” checkbox. To set that flag, use the Local Users and Groups snap-in or the command-line method.

Method 3: Local Security Policy (Windows 10 Pro/Enterprise)

This applies to local accounts on Windows 10 Pro, Enterprise, or Education editions. Home edition lacks the Local Security Policy editor.

1. Press Win + R, type secpol.msc, and press Enter.
2. Navigate to Security Settings → Account Policies → Password Policy.
3. Double-click Maximum password age.
4. Set a value in days (e.g., 30). This forces all local users to change their passwords every 30 days.
5. Click OK. The change takes effect at the next logon for each user.

To force an immediate change for a specific user, use the command-line method instead.

Method 4: Command Line (Works on All Editions)

You can set the “user must change password at next logon” flag using the net user command. This works on Windows 10 Home as well, provided you run it as an administrator.

1. Open Command Prompt as administrator (right-click Start → Command Prompt (Admin) or Windows PowerShell (Admin)).
2. Type the following and press Enter:
   net user <username> /logonpasswordchg:yes
   Replace <username> with the actual account name (e.g., net user John /logonpasswordchg:yes).
3. To verify, type net user <username> and look for “User must change password at next logon” – it should say Yes.

If you also want to set an expiration for the password, use:
net user <username> /expires:MM/DD/YYYY – but that’s for account expiration, not password. For password expiration, use the net accounts /maxpwage:30 command to set the maximum age for all local accounts.

Method 5: PowerShell (Alternative to Command Line)

PowerShell gives you the same control with a more scriptable syntax.

1. Open PowerShell as administrator.
2. Type: Set-LocalUser -Name <username> -PasswordNeverExpires $false – this ensures the password can expire.
3. Then type: Set-LocalUser -Name <username> -PasswordExpires (Get-Date).AddDays(0) – this sets the password to expire immediately, forcing a change at next logon.

Alternatively, you can combine both into one line:
Set-LocalUser -Name <username> -PasswordNeverExpires $false -PasswordExpires (Get-Date)

Method 6: Microsoft Account (Remote Reset)

For Microsoft accounts, you cannot force a password change locally in the same way. Instead, you must reset the password online, which signs out all devices and requires the user to create a new password.

1. Go to account.microsoft.com and sign in as the account administrator (if you have access).
2. Select Security → Change my password.
3. Follow the prompts to verify your identity (email, phone, or authenticator app).
4. Create a new password. This will sign out the user from all devices, including the Windows 10 PC.
5. The next time the user signs in, they must use the new password.

If you don’t have access to the Microsoft account, you can’t force a change from the device—you’ll need the user to reset it themselves via the “Forgot password” link on the sign-in screen.

Frequently Asked Questions

Does forcing a password change affect the user’s files?

No, changing a password does not delete or modify any files. The user’s profile, documents, and settings remain intact. However, if you use a temporary password, the user may need to re-enter it to access encrypted files or saved credentials.

What if the user is currently logged in?

If you set the “must change at next logon” flag, the change takes effect after the user logs out and back in. You can also force a logoff using logoff command from an admin prompt, but that may lose unsaved work.

Can I force a password change for a domain account?

Yes, but not through local settings. Domain accounts are managed by Active Directory. An administrator can use Active Directory Users and Computers to check “User must change password at next logon” on the account properties.

Will this work on Windows 10 Home?

Yes, the command-line and PowerShell methods work on Home edition. The Local Security Policy editor is not available, but you can use net accounts to set a global maximum password age.

How do I remove the “must change password” flag?

Use the command net user <username> /logonpasswordchg:no or in PowerShell: Set-LocalUser -Name <username> -PasswordExpires (Get-Date).AddDays(30) to set a future expiration instead of immediate.

What if I forget the administrator password?

You cannot force a password change without admin rights. You would need to use a password reset disk (if created earlier) or perform a system reset, which reinstalls Windows and removes accounts—this is a last resort.

Related

• Can’t Hear WhatsApp Voice Messages? Fix It
• Clear Mapped Network Drive Cache in Windows 10
• How to Use Selenium with JavaScript: A Step-by-Step Guide