Change Windows AD password from Linux

Question

Is there a way to change my Windows domain password from Linux?

Solution 1

I've done this on OS X, the same command exist on linux.

According to this site. Looks like the way to avoid adding the username to smbpasswd file to use smbpasswd -U <user> -r <IP address of DC>

Solution 2

I'm using the same solution as @JamesBarnett, I've just created a script that also gets the domain controller IP too (I never know what the IP is when I need to change my password).

#!/bin/bash

USER="your.username"
DOMAIN="yourdomain.com"

smbpasswd -U $USER -r `nslookup _ldap._tcp.dc._msdcs.$DOMAIN | awk '{print $2;exit;}'`

Comments

[user2751502]

According to the smbpasswd man page, this won't do the right thing; the -a flag means "the username following should be added to the local smbpasswd file". It's possible that the man page is incorrect; but I'm suspicious.

[JamesBarnett]

Thanks I checked the manpage and then checked google and changed the answer.

[Mike S]

The nslookup command will not work as given, because the ldap record is of DNS type SRV. You need to perform: nslookup -type=SRV ...etc... and filter it appropriately (it's more complicated than a simple awk), or better yet: $(dig SRV +noall +additional _ldap._tcp.dc._msdcs.$DOMAIN | awk '{print $5}') replaces the entire nslookup between the backticks that you have, above.

[Hakanai]

Error was : NT_STATUS_ACCESS_DENIED. But if I use smbclient -L to try and list servers, I get a different error message that my password has expired, which implies that the password I'm typing is correct.

[Hakanai]

@MikeS that command outputs multiple servers separated by whitespace, but I suspect that smbpasswd might want a single server.

[Mike S]

@Trejkaz Yes, that's what I mean by "filter it appropriately". The DNS records are of type SRV, that's for starters. How you get the SRV records I have shown. Now, how you choose a domain controller, that part I'm not sure of.

[Christoffer Reijer]

I get NT_STATUS_IO_TIMEOUT. Is there a port that must be opened for this command to work?