Command Prompt can reset a Windows local account password only if you already have administrator access or another approved recovery path; it cannot legitimately reset a Microsoft account password, and offline tricks are unsafe. The wrong method can keep you locked out, break access to encrypted files, or trigger account protection. This guide lays out the exact path for Windows 10 and 11, what CMD can do safely, and which recovery method fits local versus Microsoft accounts.
What CMD can change
Command Prompt, or cmd.exe, is the Windows command-line interpreter. Open it with cmd from Run, launch it with elevated privileges for system changes, or open it from Windows installation media with Shift + F10 during setup or recovery. (Wikihow)
The command-line password tool here is net user. Its password syntax is net user <username> <password>, and you can also use net user <username> * to be prompted for the new password interactively. That works for local accounts, not for Microsoft accounts.
Which account types are in scope?
Account type matters before you type anything. A local user account can often be changed from an elevated session. A Microsoft account password is typically changed through Microsoft’s online account recovery flow. Domain accounts follow domain policy and usually need domain admin or help desk tools, not a local workstation command.
An administrator account is not the same as a standard local user account in recovery terms. If you already have another admin sign-in, that account can change a local password. If you do not, CMD is the wrong tool unless you are in a sanctioned recovery workflow.
Why account type changes the fix
Say your laptop has a local account named Alex and a separate Microsoft account used for email. The local account password can be changed from an elevated prompt on the device. The Microsoft account password is changed through Microsoft account recovery, then Windows sign-in uses the updated online password.
That split is why many guides go wrong. They show one command and imply it fits every account. It does not.
📊 Right-clicking the Windows icon can reveal Command Prompt in Windows 10. Source: Wikihow.
When can Command Prompt reset a password?
Command Prompt can reset a password only when the account is local and the current session already has the rights needed to run the command. In practice, that means a standard local account with admin access on the machine, or a second administrator account that can authorize the change. It does not reset Microsoft or domain passwords on its own.
Local standard user accounts
A local standard user password can be changed from an elevated Command Prompt with net user. That is the cleanest fit for this tool. If the username is known and the current session has admin rights, the password can be set directly or prompted interactively.
Local administrator accounts
A local administrator account can also be changed from another administrator session. If you are already signed in as a different admin, CMD can update the target admin password with the same command. If no admin session exists, ordinary local commands do not create recovery access from nothing.
Why Microsoft and domain accounts need a different path
net user does not reset a Microsoft account password. Use Microsoft’s account recovery and then sign back in with the updated password. Domain accounts are managed by domain policy, so password changes belong in the domain’s recovery or admin tools rather than a local workstation prompt.
How do you reset a local user password from CMD?
Use an elevated Command Prompt, then run net user against the local account name. The command can either accept the new password inline or prompt for it interactively. If the account exists and you have the right privileges, the change is immediate; if not, CMD returns an error instead of a reset.
Open an elevated Command Prompt
- Press Win + R, type cmd, then press Ctrl + Shift + Enter to open it with administrator rights.
- Or right-click the Windows icon in Windows 10 and choose Command Prompt (Admin) or Windows Terminal (Admin) if Command Prompt is not shown directly.
- Confirm the UAC prompt.
Use net user with a new password
- Type net user <username> <newpassword>.
- Replace <username> with the exact local account name.
- Use a password that meets the device’s policy requirements.
- Press Enter.
Use net user with an interactive prompt
- Type net user <username> *.
- Press Enter.
- Type the new password when prompted, then type it again to confirm.
- Press Enter after each prompt.
Suppose the account name is Sam and you want CMD to prompt for the password instead of showing it in the command. net user Sam * is the safer choice in shared spaces because the password is not visible on screen.
What success and failure look like
On success, Windows reports that the command completed successfully. On failure, the most common messages point to a bad account name, missing privileges, or a password rule that blocks the new value. The command does not bypass those checks.
Command prompt reset user decision table
Use this table before you type anything. It separates local, Microsoft, and domain accounts so you do not apply the wrong recovery method to the wrong sign-in type. The safest next step is the one that matches the account, not the one that looks shortest.
| Account type | Can CMD reset it? | Safest next step |
|---|---|---|
| Local standard user | Yes, with administrator rights | Open an elevated Command Prompt and run net user <username> * |
| Local administrator | Yes, from another admin session | Sign in with a different administrator account, then change the password with net user |
| Microsoft account | No | Use Microsoft account recovery, then sign in with the updated password |
| Domain account | Usually no on the local PC | Use domain admin or help desk recovery tools |
| Utilman.exe swap rollback checklist | Not a password reset method | Restore the original file, remove temporary changes, and verify Ease of Access works normally |
What should you do if you are locked out of Windows?
If you cannot sign in, use Windows installation media or a recovery disk to reach setup or recovery, then open Command Prompt with Shift + F10. That route gives a prompt outside the normal session, which can be useful for approved recovery tasks, but it should not be used to bypass sign-in protection.
Use installation media or a recovery disk
- Boot the PC from a Windows installation disk, USB installer, or recovery disk.
- On the Windows Setup screen, press Shift + F10 to open Command Prompt.
- Use only approved recovery steps for your account type.
Choose the safest recovery path for a local account
If the account is local and you have authorized access to the recovery environment, use the official recovery path your organization allows. If the account is Microsoft or domain-based, stop and use the matching recovery service instead of trying to force a local password change.
Picture a PC that boots to the sign-in screen after a BIOS reset. If the account is a Microsoft account, changing a local password with CMD will not fix sign-in. If the account is local and the machine owner has admin access through another account, CMD can help.
If the command fails, what is most likely wrong?
Most failures come from one of three issues: the username is wrong, the current session lacks permission, or the password policy rejects the new value. Less commonly, the account is not local at all, so net user cannot do the job you expect.
Access denied
- Reopen Command Prompt as administrator.
- Confirm you are signed in with a different administrator account.
- Run net user <username> * again.
Account not found
- Run net user by itself to list local accounts.
- Check the exact username spelling, including spaces.
- Use the listed local account name in the command.
Password policy blocks the change
- Try a password that matches the device policy, including length and character rules.
- If the PC is joined to a domain, check whether the domain policy requires a specific format.
- Retry with net user <username> * after choosing a compliant password.
Not enough privilege for the account type
- Check whether the target is a Microsoft or domain account.
- If it is Microsoft, use account recovery instead of CMD.
- If it is domain-managed, contact the domain administrator or help desk.
Rollback checklist for any file-swap method
Some repair guides describe a temporary utilman.exe swap to reach Command Prompt from the sign-in screen. That is a security-bypass technique, not a normal password-reset method, so it should only be handled by an authorized administrator following local policy. If a temporary swap was made, reverse it fully after the approved repair.
- Back up the original utilman.exe before any replacement.
- Restore the original utilman.exe after the password issue is resolved.
- Remove any temporary command or boot changes used for the repair.
- Verify that Ease of Access opens normally at the sign-in screen.
- Confirm the intended account can sign in without the temporary change.
Do not leave a temporary sign-in modification in place. That creates avoidable risk and can break the next recovery attempt.
Frequently asked questions
How do I reset a user password from CMD?
Open Command Prompt as administrator, then run net user <username> *. Windows prompts for the new password twice. This works for a local account when the current session already has the right privileges. It does not reset Microsoft accounts or bypass domain policy.
What is the command prompt command to reset a local user password?
The standard command is net user <username> <password>. If you do not want the password visible in the command line, use net user <username> * and type it when prompted. Both forms are for local accounts only.
Can I change a Windows user password with Command Prompt?
Yes, if the user is a local account and you have administrator rights in the current session. Open an elevated prompt with Win + R, type cmd, then run the net user command. For Microsoft accounts, use the online recovery flow instead.
How do I reset a password if I can’t log into Windows?
Boot from Windows installation media or a recovery disk, then press Shift + F10 on the setup screen to open Command Prompt. From there, only use recovery steps that match the account type and your authorization level. Do not use a local command to try to reset a Microsoft account.
Does net user work for Microsoft accounts?
No. net user resets local Windows accounts, not Microsoft accounts tied to an online identity. If the sign-in uses a Microsoft email address, go through Microsoft account recovery first. After that, Windows sign-in uses the updated password.
Can I reset an admin password with Command Prompt?
Yes, but only from another administrator session on the same machine, or through an approved recovery workflow that grants administrative rights first. A local admin password is not the same as a Microsoft account password. If no admin access exists, CMD alone cannot create it.