How to Change Your Password in a Remote Desktop (RDP) Session on Windows Server

Applies to: Remote Desktop sessions on Windows Server and Windows, according to Microsoft’s documentation; not tested here

To change your password inside a Remote Desktop (RDP) session, press Ctrl+Alt+End. That opens the Windows Security screen of the remote server, the same screen Ctrl+Alt+Del opens on a local computer. Choose Change a password, type your current password, then the new one twice. Pressing Ctrl+Alt+Del instead only reaches your own PC.

1. Change it with Ctrl+Alt+End

1. Connect to the server with Remote Desktop and click inside the remote desktop.
2. Press Ctrl+Alt+End. According to Microsoft, this brings up the Windows Security dialog box on the remote machine.
3. Choose Change a password.
4. Enter the old password, the new password and the confirmation, then press Enter.

Microsoft notes that the Remote Desktop shortcuts don’t work in a nested session (an RDP session opened from inside another one). If the key combination does nothing, use the command line below instead.

2. Change it from the command line

Open Command Prompt or PowerShell as administrator in the session and run:

net user Administrator *

The * makes Windows ask for the new password twice without showing it on screen. Replace Administrator with the account name; net user on its own lists all local accounts. This is a reset, not a change: it doesn’t ask for the old password, so it also works for other users on the server. For a domain account, add /domain.

The PowerShell version, from Microsoft’s Set-LocalUser reference:

$Password = Read-Host -AsSecureString
$UserAccount = Get-LocalUser -Name "Administrator"
$UserAccount | Set-LocalUser -Password $Password

According to Microsoft, a password can be up to 127 characters and must meet the minimum length set with net accounts /minpwlen. Avoid typing the password directly after net user name: it would stay in the command history and be visible on screen.

3. “You must change your password before logging on the first time”

You may see this when you connect:

You must change your password before logging on the first time. Please update your password or contact your system administrator or technical support.

The account is flagged to change its password at the next logon, for example a new account, or one an administrator reset with that option ticked. With Network Level Authentication (NLA) turned on, you have to sign in before the remote session opens, so Windows has no screen on which to ask you for the new password. Microsoft’s fix is for an administrator to set a new password for that account:

net user USERNAME *

For a domain account, add /domain. After that you can connect with the new password; no restart is needed. Don’t switch off NLA on an internet-facing server to work around this, because NLA stops unauthenticated users before they reach the login screen.

4. Forgot the Administrator password on a Ucartz Windows VPS

If nobody can sign in any more, set a new Administrator password from the Ucartz client area: see change the VPS password from the client area. Some systems only use the new password after a reboot.

After changing the password

• Update the password saved in your Remote Desktop app, or the next connection fails with the old one.
• Update services, scheduled tasks and scripts that run as that account.
• Use a long, unique password: Remote Desktop on its default port 3389 is a common target for password guessing. Moving it to another port cuts the noise, see change the RDP port, and Windows Firewall rules can limit it to your own IP addresses.

Official documentation: Remote Desktop Services shortcut keys, net user and Set-LocalUser.