How to Change Another User Password in Windows 11: Methods and Safety

Changing another user's password on a Windows 11 PC is a task most home and small‑business admins will face at some point, and doing it safely requires knowing which account type you’re dealing with, the right tool for the job, and the encryption or management policies that might make a reset risky.

Background​

Windows 11 gives administrators several supported ways to reset or change passwords: the Settings app, the classic Control Panel/Computer Management consoles, Command Prompt (net user), and PowerShell (Set‑LocalUser). Each method works for local user accounts when you already have administrator privileges on the machine; Microsoft accounts and work/school (Azure AD / domain) accounts follow different flows and often require online recovery or IT helpdesk intervention. Microsoft’s documentation for changing or resetting Windows account passwords summarizes these differences and the correct recovery paths.
Community and help‑desk resources add practical notes about when to use which tool, and warn that built‑in and third‑party recovery methods can have consequences for encrypted data or managed devices.

---

Overview: Which method to use and when​

• Use Settings or Control Panel / Computer Management when you prefer a graphical workflow and you’re local admin on the PC.
• Use Command Prompt (net user) for a fast, scriptable approach that works across Home and Pro editions.
• Use PowerShell (Set‑LocalUser / New‑LocalUser) for automation and integration with management tooling.
• Use Microsoft account online recovery if the user signs in with a Microsoft account.
• Contact IT or your helpdesk if the device is joined to Azure AD or a corporate/domain environment; local hacks may be blocked or non‑compliant.

These approaches are documented in Microsoft’s support articles and validated by practical guides and community threads.

---

Changing another user’s password step‑by‑step​

Below are clear, safe procedures for each common method. Short notes highlight edition differences and risks where appropriate.

1) Settings (GUI) — easiest for most home users​

• Sign in with an administrator account.
• Press Windows + I to open Settings and go to Accounts > Family & other users.
• Under Other users, select the target account, click it, and choose Change account settings or Change password as shown in the UI.
• Enter the new password and confirm.

This is the most user‑friendly route for local accounts and mirrors the guidance Microsoft gives for users who are already signed in and need to change or reset another local account’s password. For Microsoft‑linked sign‑ins, Settings will direct you to the online account management flow instead.

2) Control Panel / Computer Management — the classic admin route​

• Press Windows + R, type control, press Enter.
• Open User Accounts → Manage another account (or open Computer Management > Local Users and Groups > Users).
• Right‑click the account you want to change and choose Set Password... or Change the password.
• Type and confirm the new password.

Computer Management’s Local Users and Groups snap‑in provides additional checkboxes such as User must change password at next logon and Account is disabled — useful for enforcing follow‑up actions. Note: the Local Users and Groups MMC is not available on Windows 11 Home; on Home you should use Settings, net user, or PowerShell instead.

3) Command Prompt (net user) — fast, works in Home and Pro​

Open an elevated Command Prompt (search cmd → Run as administrator) and run:

• To reset/change a password directly:
  net user "username" NewP@ssw0rd
• To prompt for a password (so it isn’t visible in command history):
  net user "username" *

The net user command is the long‑standing Windows CLI for creating and modifying local accounts; Microsoft documents its syntax and options, and the command works the same on Windows 11 as earlier Windows versions. Use quotes if the username contains spaces. Avoid dumping plaintext passwords into scripts or logs.

4) PowerShell (Set‑LocalUser) — recommended for scripting and automation​

Open Windows Terminal or PowerShell as administrator and run:

• Example using a SecureString:
  $secure = ConvertTo‑SecureString "NewP@ssw0rd" -AsPlainText -Force
  Set‑LocalUser -Name "username" -Password $secure

PowerShell’s LocalAccounts module provides Get‑LocalUser, New‑LocalUser, Set‑LocalUser and more — ideal when you need to deploy changes across multiple machines or as part of a management script. Be aware that some management environments (Intune, policies) may behave differently when a password change is done via PowerShell versus cmd; administrators report that net user sometimes avoids policy errors that appear in scripted Set‑LocalUser flows for certain managed devices. Test scripts in your environment before mass deployment.

---

Special cases and important caveats​

Microsoft accounts vs Local accounts vs Domain/Azure AD​

• Microsoft account (personal): Passwords are stored online. You cannot reliably change the password for a Microsoft account by editing a local user entry — instead follow Microsoft’s online Change / Reset flow (Account → Security → Change password) or use the “I forgot my password” flow. After changing a Microsoft account password online, the user will need to sign in again on the device with the new password.
• Local account: Admins on the local machine can change/reset local passwords using any of the local methods above. Resetting a local password bypasses the old credential and is immediate.
• Azure AD / Domain accounts: These are controlled by centralized identity systems. Password resets are typically handled through self‑service password reset (SSPR) or the IT helpdesk — local net user or lusrmgr changes will not update the domain credential and may not restore sign‑in if authentication is governed by Azure AD. Contact IT or use corporate tools instead.

Encryption, BitLocker, and EFS — why a reset can break access​

Two features frequently cause data loss after a password change if you’re not careful:

• EFS (Encrypting File System): Files encrypted under a user’s EFS certificate can become inaccessible after a forced password reset if the user’s EFS certificate/private key is tied to their original credential. If the account used EFS, export the EFS certificate/key before resetting the password or advise the user accordingly. Community and documentation warnings repeatedly stress this risk.
• BitLocker: Resetting a Windows login does not change BitLocker protectors. If the drive is encrypted with BitLocker and you cannot unlock it, you will need the BitLocker recovery key. Always ensure BitLocker recovery keys are backed up (Microsoft account, Azure AD / Entra ID, AD) before performing risky recovery actions.

If you’re unsure whether EFS or BitLocker are in use, pause and check: look for green file names (EFS) or check Manage BitLocker before changing passwords on accounts that may own encrypted data.

Will changing the password make the user lose files?​

Generally, no — changing a password for a local account does not delete files. However, if the user protected files with EFS or if profile encryption or credential vaults depended on the previous password, the user may lose access to those protected resources. That risk is the main reason to avoid blind password resets on machines where encryption might be used.

Can a non‑admin change another user’s password?​

No. Only accounts with administrative privileges — local administrators or domain admins — can reset other users’ passwords. Microsoft’s guidance and PC management best practice require administrative privileges for account management tasks.

---

Advanced options and administration tips​

Force a user to change password at next sign‑in​

• In Computer Management → Local Users and Groups → Users, open the user’s Properties and check User must change password at next logon.
• From the command line you can set account attributes with net user options and other tools; GUI is easiest for single users.

For automated workflows, PowerShell and Group Policy offer additional controls, but remember that certain management policies (EAS/Intune) can block some programmatic changes — administrators report occasional EAS policy errors when trying to clear the must change flag remotely. When centrally managed, prefer Intune or AD procedures.

Creating a recovery/admin backup account (recommended preemptive measure)​

It is good practice to maintain at least one alternate admin account (kept securely in a password manager) so someone can recover access without risky offline tools. Steps for creating and elevating a backup admin are straightforward in Settings or via:

• net user AdminBackup StrongPass! /add
• net localgroup Administrators AdminBackup /add

Test the backup account before you need it. Community guidance strongly recommends this precaution to avoid situations where no admin account is available.

Script hardening: avoid putting cleartext passwords into scripts​

When automating, use SecureString in PowerShell or prompt for passwords at runtime. If using net user in a script, consider interactive prompting or a secure vault. Plaintext credentials in scripts or logs are a persistent and avoidable security risk.

---

When built‑in tools fail: third‑party utilities and recovery drives​

Third‑party tools (Offline NT Password & Registry Editor, commercial unlockers) can reset local passwords by editing the SAM database offline. They are last‑resort tools with non‑trivial risks: potential data corruption, malware, and legal issues if used on devices you do not own. Prefer Microsoft‑supported flows first; if you must use third‑party recovery tools, ensure you have a full disk image backup and work on a copy. Many community posts and guides echo this caution.
If no admin account exists and recovery options aren’t available, creating and booting from a Windows recovery drive or reinstalling Windows may be the only reliable choices — but these steps can delete local data unless you image the drive first.

---

Security considerations and policy implications​

• Enforce two‑factor authentication (MFA) on Microsoft accounts to make remote compromise much harder.
• Move to passwordless options (Windows Hello, passkeys, Microsoft Authenticator) where possible — Microsoft is increasingly pushing passwordless sign‑in for new accounts and encouraging passkeys as a safer alternative. Plan recovery paths when adopting passwordless methods.
• Keep BitLocker recovery keys and any exported EFS certificates safe and separate from the device.
• For Azure AD / corporate devices, follow organizational policy rather than local hacks; identity and device management systems are designed to preserve audit trails and compliance.

---

Quick troubleshooting checklist after a password reset​

• Confirm the user can sign in locally using the new password.
• If the account is Microsoft‑linked, ensure the user signs in with the online password and reauthenticates apps (Outlook, Teams).
• Check for access to EFS‑encrypted files; if missing, locate user’s EFS backup or certificate.
• If BitLocker prompts for recovery, use the recovery key stored in the Microsoft/Entra account, AD, or other backup.
• Reconnect mapped drives and network resources that cache old credentials.

These pragmatic steps reflect Microsoft’s guidance and the experience shared by admins and community specialists.

---

FAQs — concise answers for rapid reading​

• Can I change another user’s password without admin rights? No; only administrators can reset other users’ passwords.
• Will the user lose files if I reset their password? Not usually, but EFS‑encrypted files and some credential vaults can become inaccessible after a forced reset — export keys first if needed.
• What if the account is a Microsoft account? Use Microsoft’s online Change/Reset password flow; local password changes won’t update the cloud credential.
• How do I force a user to change their password at next sign‑in? Use the Local Users and Groups console (Properties → User must change password at next logon) or the corresponding management tool in your environment.

---

Final analysis: strengths, risks, and best practice recommendations​

Changing another user’s password in Windows 11 is straightforward when the environment is simple (local accounts on unmanaged home PCs). The strengths of the built‑in options are:

• Multiple supported methods (Settings, Control Panel, net user, PowerShell) that fit different skill levels and automation needs.
• Microsoft’s online account recovery for Microsoft accounts provides robust, audited flows for remote resets without requiring local admin privileges.

However, there are clear risks and operational caveats:

• Data loss from resetting an account that used EFS or otherwise tied encryption to the old password. Always check for and export certificates if encryption is in use.
• BitLocker and device encryption complicate recovery — have the recovery key available before making significant changes.
• Managed devices (Azure AD, Intune) may block local changes or present policy‑related failures when using some programmatic tools; use the tenant’s supported reset mechanisms.
• Scripted password changes must avoid plaintext credentials and be tested under the same policy scope as production machines since remote management agents can behave differently than an interactive admin session.

Best practice recommendations:

• Maintain at least one offline or alternate administrator account and store credentials in a vetted password manager.
• Back up BitLocker recovery keys and export EFS certificates where used.
• Use Microsoft‑supported online recovery for Microsoft accounts and the organization’s identity tools for Azure AD / domain accounts.
• Prefer passwordless sign‑in and MFA where practical — but plan recovery methods before eliminating passwords entirely.

---

Changing another user’s password in Windows 11 is a routine administrative task but one that benefits greatly from a cautious, informed approach: confirm the account type, pick the supported tool appropriate to your edition and management context, and always check for encryption or management policies before taking action. When in doubt, pause and gather the BitLocker key, EFS certificates, or consult your organization’s IT policy to avoid unintended data loss or compliance issues.

---

Source: Windows Report How to Change Another User’s Password in Windows 11