bcit/changepasswd repository overview

⁠changepasswd

A minimal Docker image for changing Active Directory passwords using impacket⁠'s changepasswd.py.

⁠Quick start

docker run -it --rm bcit/changepasswd username@domain

You will be prompted for the current and new password interactively.

⁠Windows Server 2025 compatibility

Password changes against Windows Server 2025 may fail unless -protocol kpasswd is used, sometimes with the misleading error:

Target user is not allowed to change their own password

Use the Kerberos password-change protocol for compatibility with Windows Server 2025:

docker run -it --rm bcit/changepasswd -protocol kpasswd username@domain

kpasswd also works with earlier Active Directory domain controllers and requires TCP or UDP port 464 between the client and domain controller.

If port 464 is unavailable, omit -protocol kpasswd to use the container's default protocol. This fallback may fail against Windows Server 2025.

⁠Targeting a specific DC

docker run -it --rm bcit/changepasswd domain/username@dc-ip

⁠More information

Full documentation and Dockerfile at github.com/itsbcit/container-changepasswd⁠.