How to Change Password on Remote Desktop: 7 Proven Methods

You're sitting at your desk, coffee in hand, ready to start the day. You open Remote Desktop Connection (mstsc), type in the server address, and hit Connect. Then it hits you: the password expired yesterday, and you're 500 miles away from the physical machine. Sound familiar?

If you've ever wondered how to change password on remote desktop without being physically present, you're not alone. This is one of the most common pain points I hear from IT administrators and remote workers alike. The good news? There are multiple ways to do it—some you probably already know, and a few that might surprise you.

In this guide, I'll walk you through seven proven methods for updating your RDP credentials, from the standard GUI shortcut to command-line tricks and PowerShell scripts. I've used all of these in real-world scenarios over the past decade and a half, and I'll be honest about which ones work best in which situations.

---

Understanding Remote Desktop Password Requirements and RDP Credentials

Before we dive into the how-to, let's talk about why changing a password over RDP is trickier than it should be.

Why Password Changes Are Tricky in RDP Sessions

Here's the fundamental issue: Remote Desktop Protocol (RDP) authenticates using your Windows credentials—the same username and password you'd use to log into the machine locally. But when you're connected remotely, you don't have the same options you'd have sitting in front of the computer.

The classic Ctrl+Alt+Del sequence that opens the Windows Security screen on a physical machine? It doesn't work in an RDP session. Instead, Windows intercepts it and sends it to your local machine. That's why Microsoft built the alternative: Ctrl+Alt+End, which sends the command to the remote session instead.

There's another layer to this. If your organization uses Network Level Authentication (NLA) —and it should, since it's more secure—the remote machine requires you to authenticate before the session is fully established. This creates a chicken-and-egg problem when your password has already expired: you can't log in to change it, but you can't change it without logging in.

The distinction between local accounts and domain accounts matters here too. Local accounts are stored on the machine itself, while domain accounts live in Active Directory. The methods available to you depend heavily on which type you're dealing with.

Prerequisites Before You Start

Before attempting any password change, run through this quick checklist:

• Administrative privileges: Do you have admin rights on the remote machine? Most password change methods require them.
• Network connectivity: Can you reach the machine? Verify the RDP port (3389 by default) is accessible.
• Account status: Is the account locked out or disabled? If so, you'll need to resolve that first.
• Password policy awareness: Does your organization enforce complexity requirements or minimum password length? Your new password needs to comply.

Skipping these checks is the most common reason I see people get stuck. It's not that the method failed—it's that they were trying to change a password on an account they didn't have permission to modify.

---

How to Change Remote Desktop Password Using Ctrl+Alt+End

This is the method most people know, and for good reason—it's the closest thing to the standard Windows password change flow.

The Standard Method for Active Sessions

If you're already logged into the remote machine, here's what you do:

1. Press Ctrl+Alt+End on your physical keyboard while the RDP window is active. This sends the secure attention sequence to the remote machine.
2. The Windows Security dialog appears on the remote desktop. Click "Change a password".
3. Enter your old password, then type the new password twice to confirm.
4. Click the arrow button (or press Enter) to submit.

That's it. The system validates your old password, checks the new one against your organization's password policy, and updates it immediately.

One thing I've learned the hard way: make sure the RDP window has focus when you press the shortcut. If you're clicking around in a local application, you'll trigger the local Windows Security screen instead—which does nothing for your remote session.

Alternative: Using On-Screen Keyboard for Ctrl+Alt+End

Sometimes your physical keyboard just won't cooperate. Maybe you're on a laptop where the End key is shared with another function, or you're using a keyboard that doesn't have all the keys you need.

In that case, the on-screen keyboard is your friend:

1. In the RDP session, press Windows Key + R to open the Run dialog.
2. Type osk and press Enter. The on-screen keyboard appears.
3. Hold down Ctrl and Alt on your physical keyboard, then click Del on the on-screen keyboard.

This sends the same Ctrl+Alt+End sequence to the remote session. It's a workaround I've used more times than I care to admit, especially when dealing with compact keyboards or KVM switches that swallow keystrokes.

---

Change RDP Password via Command Line and PowerShell

When the GUI approach isn't an option—or you need to change passwords on multiple machines—the command line is your best friend.

Using net user Command for Quick Changes

The net user command is a classic Windows utility that's been around since the NT days. It's simple, reliable, and works on both local and domain accounts.

For a local account:

net user johndoe NewPass123! /domain

Wait—that's for domain accounts. Let me clarify:

• Local account: net user johndoe NewPass123!
• Domain account: net user johndoe NewPass123! /domain

The /domain flag tells the command to query the domain controller instead of the local machine.

If you don't want the password visible on screen (which is smart if someone's watching), use the asterisk form:

net user johndoe *

Windows will prompt you to type the password twice, without echoing it to the screen.

Important: Run Command Prompt as administrator. Otherwise, you'll get an "Access denied" error that will leave you scratching your head.

PowerShell Script for Batch Password Changes

PowerShell gives you more flexibility, especially when you need to change passwords on multiple machines or integrate with existing scripts.

For local accounts:

Set-LocalUser -Name "johndoe" -Password (ConvertTo-SecureString "NewPass123!" -AsPlainText -Force)

For domain accounts:

Set-ADAccountPassword -Identity "johndoe" -NewPassword (ConvertTo-SecureString "NewPass123!" -AsPlainText -Force) -Reset

The -Reset flag forces a password reset without requiring the old password—useful when you're an admin resetting a user's forgotten password.

Here's a script I've used to change passwords on multiple remote machines in one go:

$computers = @("SERVER01", "SERVER02", "SERVER03")
$username = "johndoe"
$newPassword = ConvertTo-SecureString "NewPass123!" -AsPlainText -Force

foreach ($computer in $computers) {
    Invoke-Command -ComputerName $computer -ScriptBlock {
        param($user, $pass)
        Set-LocalUser -Name $user -Password $pass
    } -ArgumentList $username, $newPassword
}

This requires WinRM to be enabled on the target machines, which is standard in most enterprise environments.

---

Remote Desktop Password Reset Without Admin Rights

This is the scenario that keeps IT admins up at night: you need to reset a password, but you don't have admin rights on the machine. Or worse—you're completely locked out.

When You're Locked Out: Recovery Options

If you can't log in at all, your options depend on what's available on the machine:

The built-in Administrator account: On Windows 10 and 11, the built-in Administrator account is disabled by default. But if it's been enabled (and you know its password), you can use it to log in and reset other accounts. This is a long shot in most cases, but worth checking.

Safe Mode: Booting into Safe Mode gives you access to the built-in Administrator account, even if it's disabled. From there, you can reset passwords for other accounts. The catch? You need physical or out-of-band access to the machine to boot it into Safe Mode—which defeats the purpose if you're remote.

Password reset disks: These work only for local accounts, and you need to have created them before you got locked out. If you have one, insert it and follow the password reset wizard. If you don't, this option is moot.

Third-Party Tools and Their Risks

There are third-party tools that claim to reset Windows passwords remotely—tools like Lazesoft Recovery Suite, PCUnlocker, and Offline NT Password & Registry Editor.

Here's my honest take: these tools work, but they come with significant risks.

My recommendation? Always prefer built-in methods. Third-party tools should be a last resort, used only when you have physical access and no other options.

---

Windows Remote Desktop Change Password via Group Policy

For enterprise environments, Group Policy is the backbone of password management. It's not about changing a single password—it's about enforcing policies that make password changes automatic and consistent.

Enforcing Password Expiry and Complexity Policies

If you're managing multiple machines, you don't want users to skip password changes indefinitely. Group Policy lets you enforce this:

1. Open Group Policy Management Console (gpmc.msc).
2. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy.
3. Set "Maximum password age" to your desired value (typically 30-90 days).
4. Enable "Password must meet complexity requirements" to enforce strong passwords.

These settings apply to all accounts on the machine, including those used for RDP.

Configuring RDP-Specific Password Policies

Beyond basic password policies, there are RDP-specific settings worth configuring:

• "Interactive logon: Machine inactivity limit": Forces disconnection after a set period of inactivity. This reduces the risk of someone using an unattended session.
• "Interactive logon: Prompt user to change password before expiration": Gives users a heads-up before their password expires, reducing lockout incidents.

In my experience, the second setting is a lifesaver. I can't count the number of times users have told me, "I didn't know my password was expiring!" This policy eliminates that excuse.

---

Troubleshooting: Why Can't I Change My Password on Remote Desktop?

Sometimes things go wrong. Here are the most common issues I've encountered and how to fix them.

Common Error Codes and Their Fixes

NLA and Security Settings Blocking Password Changes

Network Level Authentication can block password changes in a specific scenario: when the password has already expired. Since NLA requires authentication before the session starts, and the expired password can't authenticate, you're stuck.

There are two workarounds:

1. Temporarily disable NLA on the remote machine. This requires physical or out-of-band access, so it's not always practical.
2. Use a registry edit to allow password changes without NLA:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

Create a DWORD value called fAllowPasswordChange and set it to 1.

I should note: disabling NLA reduces security. Only do this temporarily, and re-enable it as soon as you've changed the password.

---

Syncing Windows Credentials Manager After Password Change

You've changed the password. Now comes the part most people forget: updating the stored credentials on your local machine.

Updating Stored RDP Credentials

When you connect to a remote desktop, Windows often saves your credentials in Credential Manager. If you've changed the password, the stored credentials are now outdated—and you'll get an authentication failure on your next connection.

Here's how to fix it:

1. Open Control Panel > Credential Manager.
2. Click "Windows Credentials".
3. Find the entry for your remote desktop connection (it'll be listed as TERMSRV/ followed by the machine name).
4. Click the arrow to expand it, then select "Edit" or "Remove".

If you edit, you can update the password directly. If you remove, you'll be prompted for credentials on your next connection—which is often cleaner.

Automating Credential Sync for Multiple Machines

For power users managing multiple connections, the cmdkey command is a game-changer:

cmdkey /generic:TERMSRV/SERVER01 /user:johndoe /pass:NewPass123!

This updates the stored credential for SERVER01 in one line. You can script this for multiple machines:

$servers = @("SERVER01", "SERVER02", "SERVER03")
$username = "johndoe"
$password = "NewPass123!"

foreach ($server in $servers) {
    cmdkey /generic:TERMSRV/$server /user:$username /pass:$password
}

This is one of those "I wish I'd known this years ago" tips. It saves so much time when you're rotating passwords across a fleet of servers.

---

FAQ

How can I change my remote desktop password if it has expired?

If you're already in an active session, use Ctrl+Alt+End and select "Change a password." If you're locked out because the password expired, use the command line: net user [username] [newpassword] (run as administrator). For domain accounts, add the /domain flag. If the account is locked, you'll need an admin to unlock it first.

How to change remote desktop password without logging in?

Your options are limited but not nonexistent. If the built-in Administrator account is enabled, you can use it to log in and reset other accounts. Booting into Safe Mode also gives you access to the built-in Administrator account. Third-party recovery tools exist, but they carry security risks and should be a last resort.

What should I do if I can't access remote desktop due to password?

Start by checking whether the account is locked or disabled. If it's locked, an admin needs to unlock it. Verify NLA settings aren't blocking the connection. Try a command-line password reset if you have admin access. As a last resort, consider registry edits or third-party tools—but be aware of the security implications.

Does changing Windows password affect Remote Desktop?

Yes. RDP uses your Windows credentials for authentication. When you change your Windows password, any saved credentials in Credential Manager, scripts, or services that use the old password will fail. You'll need to update those stored credentials—either through Credential Manager or using the cmdkey command.

---

Conclusion

Changing a password on a remote desktop doesn't have to be a headache. Whether you're using the Ctrl+Alt+End shortcut, command-line tools, PowerShell scripts, or Group Policy, there's a method that fits your situation.

Here's a quick recap of the seven methods we covered:

1. Ctrl+Alt+End for active sessions
2. On-Screen Keyboard when your physical keyboard won't cooperate
3. net user command for quick, scriptable changes
4. PowerShell for batch operations and domain accounts
5. Recovery options when you're locked out without admin rights
6. Group Policy for enforcing password policies across machines
7. Credential Manager sync to keep your local machine in sync

The key takeaway? Proactive password management prevents lockouts. Set reminders for password expirations, enforce policies through Group Policy, and keep your credentials synced. Future you will thank you.

Have you tried any of these methods? Share your experience in the comments below, or subscribe to our newsletter for more Windows administration tips and security best practices.