I manage a domain and I want to force all users to change their password every 3 months.

Is there a way to do this?

5 Answers 5


Provision API has gone the way of the Dodo and now you have to rewrite your script and add some extra security approvals along the way.

I got the info finally after a whole bunch of searching, after my script failed to day from here: http://thegapps.com/7/how-can-i-force-my-users-to-reset-the-password?show=8#a8

below is a summary (without the pretty pictures) for posterity.... along with my final code (with other additional enhancements I found I needed):

Start Excerpt from thegapps.com -=-

There is a Google Script that is quite small, it can serve as program changing the password every 3 months, the requirements are:

1) First with your super admin account open https://script.google.com and copy the code below and change the domain-name.com to your domain name account.

2) Please Change the Name, for example: Change Password

3) Click on Resources and 'Advanced Google Services' ** Turn on Admin Directory API ** Click on 'Google Developers Console' ** Once you are in to the Developer console, search for 'SDK' and click on Admin SDK > Then click on enable API ** Go back to Google Script and the last step

[4]) Click on 'Resources' > click on Current project's triggers' > And then ' Click here to add one now'


End Excerpt from thegapps.com

You can then specify an automated time for it to kick off using the trigger.

(NOTE: you have to do all the special stuff above to approve security to run this... oh, and remember to change example.com to your domain!! duh) This is my final solution Code below that updates Waqar Ahmad's script using the info above (which sends an email confirmation to remind you the script fired): fix for more than 100 users, has the ability to exempt a specific user from the global change:

function ForceChangePasswordAtNextLogin()  {
  //Create logs
  Logger.log('Execution started');
  Logger.log('Following users forced to change password on next login');

  var mailSent = false;

  try {
    //get all users in domain -- results are pagnated, so it will have to use nextpageToken to get each page
    var pageToken, page; 
    do { //iterate for each page
      page = AdminDirectory.Users.list({
      domain: 'example.com',
      orderBy: 'givenName',
      pageToken: pageToken
    var users = page.users;    
    //iterate for each user -- this is pagnated, so this will process only the users on this page, before moving to the next page and repeating
    for (var i = 0; i < users.length; i++) {
      if (users[i].primaryEmail == '[email protected]') { //this user is exempt from the password change
          //Put the email of the user in log
        } else {
          //set the user to change password on next login
          users[i].changePasswordAtNextLogin = true;
          AdminDirectory.Users.update(users[i], users[i].primaryEmail);
          //Put the email of the user in log
    pageToken = page.nextPageToken;
    } while (pageToken);
  //Catch if any error occurs
    //Log the error
    Logger.log('Error occured: '+e.message);
    //Send an email to yourself with logs
    GmailApp.sendEmail(Session.getEffectiveUser().getEmail(), 'Log for User Pass Change Script : Error occured', Logger.getLog());
    mailSent = true; 

    //if execution successful
    Logger.log('Execution ended. Script completed successfully');
    //Send an email to yourself with logs
    GmailApp.sendEmail(Session.getEffectiveUser().getEmail(), 'Log for User Pass Change Script: Successful', Logger.getLog());

  • thegapps.com links seem to be no longer valid.
    – bdbaddog
    Mar 9, 2016 at 18:21
  • How we enforce/trigger this in OU level ? Any one tried in OU level ?
    – user122799
    May 4, 2016 at 6:49

It is possible using the Google Apps Provisioning API. This will let you update the changePasswordAtNextLogin property to true.

Here will the flow.

  • Make a query for user account details.
  • Check updated field. If it is older than 3 months, update the changePasswordAtNextLogin property to "true". (Here I am assuming that no other field has been changed in user's account in between)

To manage the same, I wrote a Google Apps Script Code for one of my customer which runs nightly to check and update changePasswordAtNextLogin property to true if the condition is met. Hope the above idea will help you to implement it.

I have wrote a handy script on my site. Have a look: http://www.googleappsscript.org/home/force-google-apps-users-to-change-password-periodically

Reference: https://developers.google.com/google-apps/provisioning/#managing_user_accounts


Yes, this can easily be done with a third party tool like Flashpanel (not for free though)

Basically, in Flashpanel, you go to Tools | Security Tools | Reset Passwords then Create a new Password Policy. From there you select users and/or organization groups.

Quote from the page in the link above:

Want your employees to reset their passwords every 3 months? FlashPanel can do that.

I love this tool, even the free version. I recommend it for anyone managing Google Apps.

Information at flashpanel.com

  • Please note that flashpanel is now called BetterCloud.com and the free version monitors your Google Apps. Aug 14, 2016 at 21:20

Short answer: No.

Longer answer: It might be possible if you are already running a MS Active Directory or other user catalogue. Then you could set up single sign-on from your directory to Google Apps, and users will have to obide by any password policy you set on your directory. Check this example setup.


gControl is tool which quickly enable Admin to reset password for Google Apps also he can force user to create complex password to improve the security. This tool provides lot of Security to Google Apps. Must Try .

  • 2
    Do you have any affiliation with this app?
    – ale
    Jan 16, 2014 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.