> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rafftechnologies.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Reset Windows passwords and manage users

> See who is signed in to a Windows server, sign users out, unlock locked accounts and set new passwords from the Raff dashboard.

<sub>Updated October 15, 2026</sub>

The **Users** section of the Guardian tab lists the Windows accounts on the server, who is signed in and which accounts are locked out. From there you can sign a user out, unlock an account or set a new password, without connecting to the server.

Raff Guardian never does these on its own: each one runs only when you press its button. They work in every mode, **Watch only** included.

## Before you start

* Raff Guardian on the server. See [Install on an existing server](/products/manage/raff-guardian/quickstart-guides/install-on-an-existing-server).
* To see the list: `vm.view`. To sign out or unlock: `vm.manage`. To set a new password: `vm.manage` and permission to open the console (`vm.console`), signed in to the dashboard (not an API key).

## See who is on the server

Open the server under **Virtual Machines**, click **Guardian**, then **Users**. The **How to connect** card shows the server's address and a **Download Remote Desktop file** button. The **Windows users** card lists the accounts that are turned on in Windows, locked accounts first, then signed-in ones.

Each account shows:

* Its tags: **Administrator**, **built-in**, **domain account**.
* Its sessions, for example "Signed in over Remote Desktop since 09:15, idle for 20 minutes, from 203.0.113.7." A user counts as idle after 15 minutes without input.
* When it is not signed in: its last desktop sign-in in the last 90 days.
* "Locked out after too many wrong passwords" when Windows locked it.

Click **Show details** for when each password was set, the last sign-in of any kind (also SSH and file shares), services or scheduled tasks that run as the account, accounts turned off in Windows, and the server's sign-in rules. Click **Check now** for a fresh list.

## Sign a user out

1. On the account, click **Sign out** (**End session** for a disconnected session; with two sessions, **Sign out of the console** or **Sign out of the Remote Desktop session**).
2. The dialog warns that programs the user has open close without saving. Click **Sign out**, or **Not now**.

The result appears under the account, for example "Raff Guardian signed admin2 out of the Remote Desktop session." If auto sign-in is on for the account, Windows signs it in again at the next restart.

## Unlock an account

1. On a locked account, click **Unlock**.
2. The dialog says the account can sign in again at once, and after how many wrong passwords Windows locks it again. Click **Unlock**.

With [automatic blocking](/products/manage/raff-guardian/concepts/automatic-blocking) on, bots guessing passwords are blocked by address instead of locking your accounts, so you should rarely need this.

## Set a new password

<Steps>
  <Step title="Press New password">
    On the account, click **New password**. Read the dialog: the old password stops working at once (for a domain account, once the domain controllers have the change), and anyone signed in stays signed in.

    <Warning>
      For a local account, passwords the user saved in Windows (for example for Remote Desktop or in a browser) and files they encrypted with Windows cannot be opened any more. Services or scheduled tasks that run as the account fail at their next start until you give them the new password.
    </Warning>
  </Step>

  <Step title="Confirm">
    Click **Set a new password**. If the server's console is protected with two-factor authentication, enter the 6-digit code from your authenticator app. One code is enough for the next hour.
  </Step>

  <Step title="Copy the password">
    Raff Guardian makes a password of at least 20 characters on the server. **New password for** the account opens in your browser with the password: click **Copy**, then **I saved it**.
  </Step>
</Steps>

The password is shown only to you, in the browser you asked from. Raff keeps only a copy sealed to a key that never leaves your browser, and it cannot open that copy:

* **I saved it** deletes the copy at once.
* Otherwise you can show it again for 10 minutes after you first see it; then Raff deletes the copy.
* A password nobody opened is deleted after 24 hours.

Every new password sends a security email to the project's members: "A new Windows password was set". The email never contains the password. If Raff cannot send the email, nothing changes: "Raff Guardian cannot send the security email for a new password just now. Nothing changed. Try again in a minute."

If auto sign-in uses the account, Raff Guardian gives it the new password too, so the account still signs in by itself after a restart.

## What you cannot change here

| Account | Why | Do this instead |
| - | - | - |
| The built-in **Administrator** (new password) | Raff sets its password from the server's settings each time the server starts | **Reset password** on the server page. See [Reset password](/products/build/virtual-machines/quickstart-guides/reset-password) |
| A domain account on a server joined to a domain | Windows keeps it on the domain controller | Unlock it or set its password on a domain controller |
| Guest, DefaultAccount, WDAGUtilityAccount | Windows' own accounts | Nothing to do |

## Turn these actions off

Each action has its own setting under **Settings**, **Advanced: choose for each action**, in the **Users** group: **Sign out Windows users**, **Unlock Windows users** and **New passwords for Windows users**. Each takes **Ask me** (the default) or **Off**. With **Ask me**, your press is the approval; with **Off**, the button stays visible but disabled, for example "Signing users out is off in Raff Guardian's settings. Set it to Ask me first."

## Verify

The account's line updates within a minute or two: the session is gone, the lock is gone, or "Password set on" shows today. Each action and its result is also in **Activity**.

## Next steps

<CardGroup cols={2}>
  <Card title="Automatic blocking and lockout" icon="lightbulb" href="/products/manage/raff-guardian/concepts/automatic-blocking">
    Why bots no longer lock your accounts out.
  </Card>

  <Card title="Privacy and data" icon="lock" href="/products/manage/raff-guardian/concepts/privacy-and-data">
    What Raff Guardian reads about users, and what it never reads.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.