Set-ADUser -Identity <samAccountName> -ChangePasswordAtLogon $true The cmdlet itself internally update the pwdLastSet attribute.