9

We all know the official, documented, and supported way to "change" your password is to press:

  • Ctrl + Alt + Del

and then select Change Password.

Except that doesn't work if you are connected to a machine over remote desktop.

Attempt #2 - Ctrl+Alt+End

We all know the official, documented, and supported way to "change" your password on a remote computer is to press:

  • Ctrl + Alt + End

This hotkey combination is sent by the Remote Desktop Client to the server as Ctrl+Alt+Del, causing the option Change Password to appear.

But if you are connected to an RDP session, which is connected to an RDP session, then you cannot use CAD or CAE; because neither reach the final final final computer.

Attempt #3 - On-screen keyboard

Some people suggest a workaround here is to use the on-screen keyboard inside the RDP window inside the RDP window, and then press Ctrl + Alt + Delete on the on-screen keybaord.

Except we all know that doesn't work:

enter image description here

Attempt #4 - Change account settings

And the final insult is if you try to go to your account to "change" your password, and it tells you the most unhelpful thing:

enter image description here

How do you change your password on a machine that you are connected to through 2, 3, 4, or more levels of RDP indirection?

Attempt #5 - More attempts at using the on-screen keyboard

  • Machine 0: RDP into machine 1.
  • Machine 1: RDP into machine 2.
  • Machine 2: Open the On-Screen Keyboard.
  • Machine 2: RDP into machine 3. Un-fullscreen the RDP session.
  • Machine 2: Use the OSK to press Ctrl-Alt-End.

Does nothing.

Attempt #6 - pspasswd

This does not change my password; it resets it.

Attempt #7 - More attempts at "Change account settings"

Doesn't work because there is no option to change your password:

enter image description here

Attempt #8 - net user

This does not change my password; it resets it.

Bonus Chatter

I say "change" your password (in quotes), as to distingush it from "resetting" your password.

  • the former changes your password
  • the latter causes you to lose access to all your certificate private keys, saved passwords, etc

Because you "reset" your old password rather than "change" it, and those private things are encrypted (essentially) with your password.

How do you access the Windows Change password user interface over remote desktop, over remote desktop, over remote desktop?

Regarding 3rd party applications: Corporate policies and security people lose their minds when i instal 3rd party software on the internal servers. I have no problem telling them where to go. But any answer should probably be suitable for the people who are afraid of telling security people, auditors, and governments where to go.

Ian Boyd
  • 21,642
  • 49
  • 139
  • 184
  • 1
    Is the PowerShell `Set-ADAccountPassword` cmdlet an option available to you? – spikey_richie Jul 09 '21 at 20:29
  • @spikey_richie *"The term 'Set-ADAccountPassword' is not recognized as the name of a cmdlet, function, script file, or operable program."* Also that *"resets"* someone's password, where we need to "change" their password (which requires knowing the old password - otherwise they lose all their encrypted data - bad bad bad bad bad bad bad idea) – Ian Boyd Jul 10 '21 at 21:35
  • 2
    Can't you open a cmd with Administrator priviledge, and do `net user Username NewPassword` ? – 1NN Mar 30 '23 at 18:41
  • If you can change the software, It looks like anyviewer has a dedicated `ctrl+alt+del` command: https://www.anyviewer.com/how-to/ctrl-alt-delete-remote-desktop-8657.html – 1NN Mar 30 '23 at 20:00
  • Also, maybe sticky keys might work ? https://superuser.com/a/873638/714576 – 1NN Mar 30 '23 at 20:04
  • @IanBoyd - Can you temporarily change when passwords are due to be changed, attempt to login into the account and change the password, then change the password expiration group policy back? – Ramhound Mar 31 '23 at 02:38
  • You may use [PsPasswd](https://ss64.com/nt/pspasswd.html) like `pspasswd \\workstation64 jdoe password567`. – harrymc Apr 01 '23 at 07:49
  • What's that about the keys? It'd seem like you ARE a part of a domain, meaning that your user ID has all the access and the password is just a string to authenticate against Kerberus. Your USER has the access - not the password. **Did I misundestood that?** – Netan Apr 01 '23 at 10:48
  • @1NN *"Can't you open a cmd with Administrator priviledge, and do `net user Username NewPassword` ?"* I could do that, but that would reset my password to a new password, rather than change it to the new password. – Ian Boyd Apr 03 '23 at 20:16
  • https://learn.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate – Vomit IT - Chunky Mess Style Apr 05 '23 at 22:50
  • For your attempt #3 can also try CTRL + ALT on the physical keyboard then click the DELETE key on the on screen keyboard in the deepest remote desktop. – Brian Apr 06 '23 at 02:23
  • [this article](https://virtuallyjason.blogspot.com/2019/02/changing-your-windows-password-in.html) suggests you can open a PowerShell and run the command `(New-Object -COM Shell.Application).WindowsSecurity()` – 1NN Apr 08 '23 at 07:57
  • @1NN If you paste that into a powershell console, and press Enter, nothing happens. No security prompt, no error message, no text response in the console. *Nothing*. – Ian Boyd Apr 09 '23 at 13:07
  • Sorry. That must have been discontinued. You might want to ask your question again on [ServerFault](https://serverfault.com/) which has a few threads on this issue. One last shot: [this thread](https://serverfault.com/questions/359976/send-ctrl-alt-del-to-nested-rdp-session) on serverfault has an suggestion which sounds promising (but which I can't test) _"to send `Ctrl+Alt+Del` to a remote machine, simply use the OSK to send `Ctrl+Alt+End` from the session just before the remote machine you are trying to send it to. Works every time."_ More details [here](https://serverfault.com/a/387716) – 1NN Apr 10 '23 at 14:11

7 Answers7

2

I was having the same issue but I am on the Remote Desktop Web Client.

from some Microsoft Documentation I managed to change my password by hitting Ctrl+Alt+End from my physical keyboard that triggers Ctrl+Alt+Del on the remote session, perhaps some variation of this via being triggered from inside the first remote to the second remote triggers this.

Dominique
  • 1,993
  • 9
  • 30
  • 65
Ivan
  • 21
  • 2
  • Thanks for the tip. Actually, holding Ctrl+Alt on physical keyboard and clicking Del button on the on-screen keyboard in remote desktop did the trick. – Alex Ureche Sep 01 '23 at 00:41
1

This answer has 17 upvotes in a separate superuser thread. Hope it works for you:

STICKY KEYS IS THE ANSWER

There is another way which will work regardless of OS and as many nested RDC sessions as you can wrap your head round. With the focus in the inner most RDC session, quickly press the shift key 5 times. This will bring up the Sticky Keys window, and one window for each level of nesting. When prompted to turn on sticky keys, click Yes/Ok for your most nested session, and No/Cancel for the outer sessions. Now with the focus still on the inner most nested session, press ctrl (then let go), press alt (then let go), press delete.

Tadah!

To turn off sticky keys, with the focus on the nested session, press shift 6 times and click No/Cancel.

1NN
  • 5,232
  • 1
  • 17
  • 37
1

Press ctrl+alt on the physical keyboard followed by del on the on screen keyboard.

Brian
  • 8,896
  • 23
  • 37
0

A. Try to press the start button > tap on the user name > settings > change password. enter image description here

B. Search for "Computer Management" in the start menu and launch it. Then go to "Users Management", right click on your user and then select "Set password". enter image description here

Edit:

As it would seem, since you are probably not a domain admin, just call tech-support and ask them to reset your password. They can tick "ask for password next login" in Active-Directory, which will make you select a new password for the user account.

I don't understand the problem between reseting and changing your password and have commented about it in response to your message.

Netan
  • 574
  • 2
  • 11
  • I've commented like that because I know I'm right. The second method works for both Domain-joined and Non-domain-joined computers, and over several layers of RDP. The leading answer IS a heck of a guess... He just spoke with much more confidense! Did you downvote my answer? Did Ian ever tried to use that? Did he encountered a problem? – Netan Apr 01 '23 at 09:17
  • I mean... re-reading that - I'm not mad or something... This answer will solve it for future members coming accross this conversation... But it WAS more helpful than it currently is. – Netan Apr 01 '23 at 10:39
  • “I don't understand the problem between reseting and changing your password and have commented about it in response to your message.” - It disables access to any files encrypted with EFS unless you have the original certificate. It also breaks credential manager. Resetting a password isn’t what the author wants. – Ramhound Apr 01 '23 at 15:08
  • I meant like, I'm really familiar with Windows etc but never heard that changing a password for a DOMAIN USER will interfere with Bitlocker or any imported certificates. The user is being identified with his SID and the system is being decrypted long before logon screen. – Netan Apr 02 '23 at 16:10
  • A warning when you Reset a user’s password specifically warns you have potential issues with encrypted files. – Ramhound Apr 02 '23 at 16:34
  • A) There is no "`change password`". B) The problem with resetting a user's password is that it resets their password - rather than changing their password. The difference is that if you reset their password, they lose all their private keys, encrypted certificates, stored passwords, lose access to all their encrypted files. That's why you should never reset someone's password. – Ian Boyd Apr 03 '23 at 20:03
  • Note that EFS is entirely unrelated to BitLocker, which is not affected. – Daniel B Apr 04 '23 at 15:36
  • Also: yes, i did try to use your answer. Under "Change account settings" there is no option to change my password (see my screenshot in the question which shows the lack of an option, and your screenshot in your answer which has no option). Regarding your 2nd option, of **Set Password**, that *"resets"* a user's password, rather than *"changing"* it. All your secrets (e.g. Chrome stored password, IE stored passwords, NTFS encryption certificate private keys) are all protected on Windows (ultimately) with your password. If someone steals your PC they cannot recover any of your passwords. – Ian Boyd Apr 05 '23 at 13:48
  • When you **change** your password, the secrets are decrypted with the old password, and then re-encrypted with the new password (not pedantically true, but true enough for our purposes - [gory details here](https://www.passcape.com/index.php?section=docsys&cmd=details&id=28)). The point is: i am asking how to **change** my password, not **reset** it. As far as i know the only UI available in Windows to change a password comes through the **Secure Attention Sequence** (SAS) (i.e. `Ctrl`+`Alt`+`Delete`). And the SAS is a nightmare to trigger over RDP over RDP over RDP. – Ian Boyd Apr 05 '23 at 13:49
  • The user **might** be able to recover their data if they then "change" their password back. But a) i'm not risking testing it on my PC, b) changing your password back to a previous password runs afoul of policy requirements put in place by people who don't understand security. But since i'm not allowed to go into gpedit on their servers, and then add a **Deny** entry to `Policies` key in the registry to deny `System` and `TrustedInstaller` from restoring the corporate policies on the server: i'm left to just ask the question - How to change my password over rdp over rdp over rdp. – Ian Boyd Apr 05 '23 at 13:54
  • @IanBoyd a) It IS a serious security risk, but... why not running AnyDesk on the end device? Or on the one before that? b) If it's THAT important, then ask the support to log you in using their console-view from ESX/whatnot. c) Ask the organization for a specific GPO that allowes you to just change your password yourself. d) save data on the corporate drive, like everyone in the organization is required anyhow, then you'll be able to work even if HQ will collapse in an earthquake. – Netan Apr 05 '23 at 15:43
  • @IanBoyd As I said in my answer, you're trying to do something you don't have credentials for. Do not try to BYPASS if you can ask for HELP. – Netan Apr 05 '23 at 15:44
0

For changing the password of a remote network computer, you may use the free PsPasswd.

Example :

pspasswd \\workstation64 jdoe password567

The description of the pspasswd command-line :

Syntax

pspasswd [[\\computer[,computer[,..] | @file 
     [-u user [-p passwd]]] Username [NewPassword]

Options:

computer   The computer on which the user account resides. Default=local system 

-p passwd  Specify a password for user (optional). Passed as clear text.
           If omitted, you will be prompted to enter a hidden password.

-u user    Specify a user name for login to remote computer(optional).

@file      Execute the command on each of the computers listed in the file.

Username   Name of account for password change.

NewPassword  The new password, If ommitted a NULL password is applied.

-accepteula Suppress the display of the license dialog.

Related command for use on the local computer is net user, whose syntax is one of the following:

net user [<UserName> {<Password> | *} [<Options>]] [/domain]
net user [<UserName> {<Password> | *} /add [<Options>] [/domain]]
net user [<UserName> [/delete] [/domain]]

Since there seems some disagreement on whether PsPasswd changes or resets the password, although when Mark Russinovich says "change an account password" I do tend to accept his words as-is, I did find a commercial product that is explicitly said to change the password.

The product is Password Assistant, part of the EventSentry suite of utilities. It's unclear whether this product is free if used alone or priced at $98.00 per Windows device (if it requires buying the entire suite).

In a review at FREE: Password Assistant – Change the local administrator password on multiple computers, where the author discusses the difference between Password Assistant and a previous product that he reviewed, he says:

A while back I discussed the similar tool NetWrix Bulk Password Reset. The main difference between Password Assistant and the NetWrix tool is that with the latter, you reset the password, whereas with the Password Assistant you change the password. "Resetting" means that you don't have to know the current password, whereas to "change" the password you have to specify the old password. Changing the password is usually the preferable method because, if you reset the password, the user might lose data such as EFS encrypted files or stored Internet Explorer credentials.

harrymc
  • 455,459
  • 31
  • 526
  • 924
  • The problem with **resetting** a user's password is that it **resets** their password - rather than **changing** their password. The difference is that if you **reset** their password, they lose all their private keys, encrypted certificates, stored passwords, lose access to all their encrypted files. That's why you should never **reset** someone's password, but instead **change** it. I want to **change** my pasword. – Ian Boyd Apr 03 '23 at 20:01
  • I'm not sure that `pspasswd` resets the password, as after all it needs the current password in order to do its job. It might need some testing, but I would think that it does the same as logging in and changing the password. For reset, it would just need the credentials for an admin login. The [documentation](https://learn.microsoft.com/en-us/sysinternals/downloads/pspasswd) also says "change an account password", and Mark Russinovich is very specific about Windows terminology. – harrymc Apr 03 '23 at 20:06
  • In any case, I added one more product to my answer. – harrymc Apr 05 '23 at 09:01
0

This is a long shot - do you have the option to download TeamViewer on both machines? This will give you the command to run Ctrl Alt Del on the end machine.

I appreciate it doesn't resolve resetting via RDP but you have tried all of the answers I could come up with so this ones more a workaround suggestion.

DeltaSun510
  • 1
  • 1
  • Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Apr 06 '23 at 12:34
0

I can't remember exactly where I found this before, but this works for me when using an alternative RDP client (Remmina, where I can't enter Ctrl+Alt+End) to access Windows 10 from Linux.

C:\Windows\explorer.exe shell:::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}
Andrew Gilchrist
  • 1
  • Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Jun 17 '23 at 04:50