Reset Your Password Through Remote Desktop

Eric DawsonByEric Dawson Computers & Software

To learn how to reset password remote desktop, click inside an active Windows RDP window, press Ctrl+Alt+End, choose “Change a password,” then enter your current password and the new password twice. Ctrl+Alt+Delete normally affects your local computer, not the remote Windows session.

If you are connecting through nested RDP or a jump host, open osk.exe in the innermost session, hold Ctrl+Alt on your physical keyboard, and select Del on the On-Screen Keyboard. When an expired password or required first-logon change blocks RDP through Network Level Authentication, use an administrator-provided route such as a configured RD Web Access password page.

How to Reset Password in Remote Desktop

A signed-in Windows user can change a known account password in a standard Remote Desktop Protocol session by opening the remote Windows Security screen with Ctrl+Alt+End and selecting “Change a password.” Instead of resetting an unknown credential, this self-service route requires the current password and applies the local or domain password policy assigned to the account.

Change Your Password from an Active Session

Before using the shortcut, click within the remote desktop window so the session, rather than another local window, has keyboard focus. For what is often called a Ctrl+Alt+End password reset, follow these steps while the connection is active and the account remains signed in.

  1. Click anywhere inside the remote desktop window.
  2. Press Ctrl+Alt+End to open the remote Windows Security dialog.
  3. Select “Change a password” from the available options.
  4. Enter the current password once, then type the new password in both new-password fields.
  5. Confirm the change by pressing Enter or selecting the confirmation arrow.

Windows can display a message reading “Your password has been changed” after a successful update. Available choices on the Windows Security screen can vary by Windows edition, session type, account, and administrator policies. Those choices may include Lock, Sign out, Change a password, Task Manager, and Switch user. Because Ctrl+Alt+End opens the remote security options, it does not by itself change the password or alter the connection’s security.

Check the Remote Session First

Classic Windows Remote Desktop Connection users can start the client with mstsc, connect to the computer, click inside the session, and then use Ctrl+Alt+End. If the RDP window is not full-screen, the client’s keyboard setting can determine whether Windows key combinations go to the local computer, only to the remote computer while full-screen, or to the remote session whenever it is active. Compact keyboards may lack a dedicated End key, so use the keyboard manufacturer’s documented Fn or secondary-key equivalent.

Saved RDP connections may retain the old password after a successful change, so update stored credentials before the next connection. Afterward, sign in with the new password to verify that the change worked. Remember that a normal in-session password change is for a user who knows the existing password and can already access the remote Windows session.

Why Ctrl+Alt+End Replaces Ctrl+Alt+Del

Ctrl+Alt+End replaces Ctrl+Alt+Del because Windows reserves Ctrl+Alt+Del for the computer at which you are sitting. During an RDP connection, that secure-attention sequence is captured locally instead of being passed into the remote desktop. Pressing the End-key version asks the remote Windows session to display its Windows Security screen, where account actions appear. That distinction prevents a local security command from being confused with one intended for a remote machine.

First check for a User Account Control prompt that may be layered above the session, because it can keep keystroke from reaching RDP. Also review that setting when the window is not full-screen. On Windows, it governs Windows key combinations.

Full-screen mode therefore can change how keyboard input is directed, but Ctrl+Alt+End remains a request for the remote Windows Security screen, not a security control for the connection itself. Depending on the client and device, the equivalent differs. Microsoft Remote Desktop web client on Windows uses Ctrl+Alt+End, while macOS shortcut is Fn+Control+Option+Delete. Mac users of Windows App in a browser use Fn+Control+Option+Backspace instead.

Nested RDP sessions need a different approach because Ctrl+Alt+End cannot change a password through multiple RDP hosts or jump hosts. Launch On-Screen Keyboard in the innermost remote session by entering osk.exe in Start > Run. Then use the on-screen keyboard in the innermost session. Because nested Remote Desktop or RemoteApp shortcuts may behave differently, this workaround is not guaranteed in every client configuration.

Finally, avoid assuming that every Windows Security screen will look alike. Available choices vary. An administrator may offer a toolbar or menu command that injects Ctrl+Alt+Delete in third-party remote-control software. Treat product-specific control separately from standard RDP behavior, and avoid repeatedly pressing Ctrl+Alt+Del expecting it to reach the remote computer.

Change Password in Remote Desktop on Different Clients

Client choice determines which shortcut you use to change password in Remote Desktop. Windows users in an active classic Remote Desktop Connection session can use Ctrl+Alt+End, while the Microsoft Remote Desktop web client on Windows uses the same shortcut, while Windows App running in a browser on macOS uses Fn+Control+Option+Backspace. Neither Mac sequence is universal across Microsoft clients.

Compact keyboards may need the manufacturer’s equivalent. Consult the keyboard’s layout or documentation before attempting a Ctrl+Alt+End password reset, since the End function can be assigned differently between models. The On-Screen Keyboard offers another route. That approach sends the secure-attention sequence without requiring a dedicated End key.

Full-screen status can change where Windows key combinations go in a Remote Desktop Connection window. Use the client’s configured keyboard setting. Classic Windows Remote Desktop Connection starts with mstsc, then follows its configured keyboard behavior after the session opens. Browser-based Microsoft clients use the listed injection shortcuts instead of a single Mac command that applies everywhere.

Explorer supplies another in-session route when a keyboard sequence is inconvenient: run explorer.exe shell:::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}, then choose “Change a password.” That command opens the Windows Security prompt. Follow the product’s remote-security command rather than assuming Ctrl+Alt+End works identically in every remote-access tool.

Available Windows Security options can vary between environments. Select the password option when it appears, and use the client shortcut that matches the device and Microsoft application in use.

Reset a Password Through Nested RDP Sessions

When you connect through a jump host or multiple Remote Desktop layers, open the Windows Security screen from the innermost remote session. Instead of using Ctrl+Alt+End, launch the On-Screen Keyboard there and use it to send Ctrl+Alt+Del to that specific computer.

Send Ctrl+Alt+Del to the Innermost Session

From that same session, hold Ctrl+Alt on your physical keyboard and select Del on the On-Screen Keyboard. Once the remote Windows Security dialog appears, choose “Change a password.” Then enter the current password, type the new password twice, and confirm the change.

Because each RDP layer can receive keyboard input separately, the normal shortcut may reach an outer session instead of the computer where the password must be changed. At the lowest layer, the On-Screen Keyboard method targets the active remote Windows session.

Use the Method as a Workaround

For a compact keyboard, the On-Screen Keyboard can also provide a practical route to the Windows Security dialog. An alternative way to open it is to press Windows+R, type osk, and press Enter. Administrators may also provide a password-change shortcut or another approved route for users working through Remote Desktop Session Host environments. That approach can be useful when users regularly need to change password in remote desktop sessions.

Keep the On-Screen Keyboard open until the password update is complete, since closing it before sending the key combination means the innermost session will not receive Ctrl+Alt+Del. A nested-session workaround does not bypass sign-in requirements or password policy rules. For expired passwords, use the administrator-provided route described earlier before beginning a remote session.

Remote Desktop Password Expired Before Sign-In

Use an administrator-provided reset route. Because Network Level Authentication, or NLA, authenticates the user before an RDP session opens, the normal in-session password-change screen is unavailable. Use the organization’s supported identity-management or administrator reset process rather than attempting to bypass the sign-in barrier.

Why RDP Cannot Open the Password Screen

Network Level Authentication is enabled by default for RDP in modern Windows versions and uses Credential Security Support Provider authentication before the remote desktop starts. An expired password, or an Active Directory account marked “User must change password at next logon,” can therefore stop the connection before Windows presents any session controls.

That failure can display: “You must change your password before logging on the first time. Please update your password or contact your system administrator or technical support.” Instead of treating this as a Ctrl+Alt+End password reset problem, treat it as a pre-login account-management issue.

Situation Recommended Route Action or Path Limitation
Password expired before RDP sign-in Administrator-provided password-change method Use the organization’s supported reset route An ordinary RDP session cannot open while NLA blocks authentication
RD Web Access is configured RD Web Access password page https://[RDWEB-HostName]/RDWeb/Pages/en-US/password.aspx The administrator must enable the password-change facility
Local account needs an administrator reset Computer Management compmgmt.msc > System Tools > Local Users and Groups > Users > Set Password This is an administrator reset, not a user change with the current password
Domain account needs an administrator reset Active Directory PowerShell Set-ADAccountPassword -Identity "username" -Reset … Requires RSAT and domain-administrator or delegated permissions

For deployments that use RD Web Access, administrators can enable expired-password changes through IIS Manager at Sites > Default Web Site > RDWeb > Pages > Application Settings. A setting named PasswordChangeEnabled must be set to true before the web password facility is available. Password pages use the en-US path segment shown above, while servers with a language pack use the installed language code, such as de-DE.

Administrator Actions and Safer Planning

Administrators can reset a local account through Computer Management, or use net user <username> * from an elevated Command Prompt to avoid displaying the new password in the command. Domain accounts can be reset with Active Directory PowerShell using Set-ADAccountPassword, provided the administrator has RSAT plus appropriate domain or delegated permissions. After a reset, users should follow the approved sign-in process with the new credential.

Where possible, notify users before Active Directory passwords expire rather than expecting them to resolve an expired credential from the RDP sign-in screen. Before expiry, an active remote session can still use the ordinary change-password process. Organizations should not present disabling NLA as a default end-user fix, since that approach is not recommended.

Administrator Options for Local and Domain Accounts

Reset Local Windows Accounts

For a local account, open Computer Management by right-clicking “This PC” on the remote desktop and choosing “Manage,” or run compmgmt.msc. From there, go to System Tools > Local Users and Groups > Users, right-click the account, choose “Set Password,” and enter the replacement password twice.

That route is described as generating Event ID 4724 in the Security Log for auditing. Control Panel also offers an account-management path: run control.exe, then choose User Accounts and Change your password, or use User Accounts > Manage another account > Change the password.

Alternatively, an administrator with local administrator rights can run net user <username> * from an elevated Command Prompt and enter the new password when prompted. Using the asterisk avoids displaying the new password in the command itself. PowerShell 5.1 or later supports Set-LocalUser -Name "username" -Password (ConvertTo-SecureString -AsPlainText "new_password" -Force) for a local user.

Reset Domain Passwords Remotely

Domain accounts call for Active Directory administration rather than local-user tools. With Remote Server Administration Tools and domain administrator or delegated permissions, use Import-Module ActiveDirectory ; Set-ADAccountPassword -Identity "username" -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "NewP@ssw0rd." -Force). This command resets a domain password remotely; replace the sample account identity and password values before running it. Any new local or domain password still has to meet the applicable password-policy settings.

Where staff need a visible password-change command instead of a full reset, PowerShell can open Windows Security with (New-Object -COM Shell.Application).WindowsSecurity().

On Remote Desktop Session Host systems, administrators can place a WindowsSecurity.vbs launcher on the shared desktop at %SystemDrive%\Users\Public\Desktop\ or copy it to user desktops through Group Policy. Inside that file, set objShell = CreateObject(“shell.application”)
objshell.WindowsSecurity opens the Windows Security dialog when users double-click it.

Before selecting a method, distinguish a local account from a domain account and use an administrator action that matches the account’s management environment. Administrators should also treat the PowerShell and Explorer options as ways to open a password-change prompt, not as local or domain reset commands.

Update Saved Credentials After a Password Change

After changing a password, update any saved Remote Desktop connection that still holds the old credential, then verify a successful sign-in with the new password. Retained old credentials can prevent future logins even when the password change succeeded.

Before opening a session again, check the connection or credential entry you normally use and replace the stored password with the new one. A successful sign-in with the updated credential is the practical confirmation that Remote Desktop is using the current password. If the account is a local Windows account or a domain account, that same Windows credential is the one used for the RDP session.

Accounts managed through Entra ID should have their passwords changed online through Microsoft’s dedicated site rather than within the RDP session. Organizations that use Okta, OneLogin, or Ping may direct users to an internal website or another designated system instead. Follow the password route assigned to that identity provider, and use the new password when the Remote Desktop connection next requests credentials.

When a Remote Desktop password expires before sign-in, a successful update in the approved portal or password page should be followed by an RDP sign-in using the replacement password. Avoid relying on a previously saved entry, because it can continue sending the prior password. For users who change their password in an active remote session, the same post-change check applies: update saved connection credentials and confirm a new login. Keeping the stored connection current helps prevent an old credential from causing the next connection attempt to fail.

Also, remember that password requirements follow the applicable local or domain policy, so a newly chosen password must satisfy the rules that apply to the account. Where an identity provider manages credentials, the organization’s designated website or system is the appropriate place for its password process. That distinction matters because Remote Desktop can use a Windows domain credential, a local Windows credential, or credentials managed through Entra ID or another provider as assigned by the organization.

This guide does not prescribe your organization’s password rules; follow the policy assigned to your account.

Frequently Asked Questions

How Do I Send Ctrl+Alt+Del Through Remote Desktop?

Click inside the remote desktop window, then press Ctrl+Alt+End to open the remote Windows Security screen. Standard Ctrl+Alt+Del is captured by the local computer instead of being passed to the RDP session. From Windows Security, select “Change a password” and enter the current password followed by the new password twice.

Why Does Ctrl+Alt+End Not Work in My RDP Session?

First, make sure the remote desktop window has keyboard focus and that no local User Account Control prompt is sitting above it. A non-full-screen RDP window may also follow the client’s keyboard-combination setting. Compact keyboards may require an Fn or secondary-key combination for End, while nested RDP and RemoteApp sessions can prevent the shortcut from reaching the intended computer.

Can I Change an Expired Password Through Remote Desktop?

An expired password can prevent an RDP session from starting when Network Level Authentication is required. Since the Windows Security password screen is available only after connecting, the usual Ctrl+Alt+End method cannot solve that sign-in barrier. Use the earlier alternative instead.

How Do I Reset a Domain Password Remotely?

Beyond that, an administrator with RSAT and domain-administrator or delegated permissions can use Active Directory PowerShell to reset a domain account password. The command begins with Import-Module ActiveDirectory and uses Set-ADAccountPassword -Identity "username" -Reset with a secure-string password. This is an administrative reset, rather than the normal self-service change that requires the user’s current password.

How Can I Change a Password Through a Nested RDP Session?

Open the On-Screen Keyboard in the deepest remote session by running osk.exe. Hold Ctrl+Alt on the physical keyboard, then select Del on the On-Screen Keyboard to send Ctrl+Alt+Del to that session. Ctrl+Alt+End cannot be used through a chain of multiple RDP hosts, and the On-Screen Keyboard workaround can vary by client configuration.

Can an Administrator Reset a Local Account Password over RDP?

An administrator can open compmgmt.msc, go to System Tools > Local Users and Groups > Users, right-click the local account, and select “Set Password.” Another option is an elevated Command Prompt command: net user <username> *, which prompts for the new password rather than displaying it in the command. Both approaches are administrator actions for local accounts.

For an active Windows RDP session, Ctrl+Alt+End remains the standard path to a password change: focus the remote window, open Windows Security, and choose “Change a password.” Password expiry and NLA can block that route before a session begins, making an organization-provided alternative such as configured RD Web Access necessary. Administrators can reset local or domain accounts with management tools when they have the required rights, while nested connections may require the On-Screen Keyboard workaround.

References

Sources read in September 2026.

Eric Dawson

I'm Eric Dawson, and I write The Money Watch from north Columbus, Ohio. Most of what I cover comes from my own life: renting, a 2014 Honda Fit, parking, computers, food and the bills behind all of it. I spent four years in an apartment-property office and eleven on a distributor's operations desk, reading leases and invoices. Where you need real information, I research the maker's or agency's own page and independent sources and report what they publish. I don't give tax, investment, legal or medical advice.