Creating passwords for Windows VMs

Windows

Windows Server instances use password authentication instead of SSH authentication. To prevent unauthorized access to new Windows instances, Compute Engine requires that you generate a new Windows password for that instance before you connect to it. If you forget your password, you can generate a new one using this same process.

On Windows, the following built-in accounts are disabled by default:

Administrator
Guest
DefaultAccount
WDAGUtilityAccount

The Windows guest agent can reset the passwords for these accounts, but doing so does not enable the accounts if they are disabled nor does it set additional policies so that the user can log in to the VM.

The accounts can be renamed by the local security policy, which is used by many organizations, so the built-in accounts are not guaranteed to have the default names. If the accounts have been renamed, then original names can be used.

Before you begin

If you want to use the command-line examples in this guide, do the following:
1. Install or update to the latest version of the gcloud command-line tool.
2. Set a default region and zone.
Create a Windows instance.

Generating a password

You can generate Windows passwords using either the Google Cloud Console or the gcloud command-line tool. Alternatively, you can generate passwords programmatically with API commands. If you forget your password, you can also use this procedure to reset it.

Permissions required for this task

To perform this task, you must have the following permissions:

compute.instanceAdmin.v1 on the instance
iam.serviceAccountUser on the service account if the instance has an attached service account

Console

Go to the VM instances page.

Go to the VM instances page
Click the Windows VM to change the password on.
On the VM instance details page, click Set Windows password.
In the Username field, enter the username to change the password for, or enter a new username to create a new user.
Click Set.

gcloud

Use the gcloud compute reset-windows-password command to create a new account and password or reset the existing account password for the logged in user:

gcloud compute reset-windows-password instance-name

You will be presented with a confirmation prompt; this will need to be accepted by entering Y and/or pressing Enter. It can be rejected by entering N, then pressing Enter.

This command creates an account and sets an initial password for the
user [username] if the account does not already exist.
If the account already exists, resetting the password can cause the
LOSS OF ENCRYPTED DATA secured with the current password, including
files and stored passwords.

For more information, see:
https://cloud.google.com/compute/docs/operating-systems/windows#reset

Would you like to set or reset the password for [username] (Y/n)?

Once confirmed, confirmation of password reset will look as follows.

Resetting and retrieving password for [username] on [instance-name]
Updated [https://www.googleapis.com/compute/v1/projects/project-name/zones/zone/instances/instance-name].
ip_address: ip-address
password:   password
username:   username

You may now connect to the instance using the provided username and password combination.

Changing a password

Compute Engine generates a random password, but you should change the password to a custom password that is meaningful to you. To set a custom password, connect to your Windows VM instance using the generated password, and then do the following:

Command prompt

Use the net user command to change the password.

Windows Server 2012 R2

After the desktop finishes loading, click the Start menu icon.
Click Control Panel.
Under the User Accounts icon, click either Change Account Type or Add or remove user accounts.
Select the account that you want to modify.
Click Change the password.
Enter your current password and your new password.
Click Change password to save your changes.

Windows Server 2016

After the desktop finishes loading, click the Start menu icon.
Click Control Panel.
Under the User Accounts icon, click either Change Account Type or Add or remove user accounts.
Select the account that you want to modify.
Click Change the password.
Enter your current password and your new password.
Click Change password to save your changes.

Windows Server 2019

After the desktop finishes loading, click the Start menu icon.
Click Settings.
Click Accounts.
Click Sign-in options.
Under Password, click Change.
Enter your current password and click Next.
Enter your New password, in Reenter password enter the new password again, enter a Password hint, and click Next.
Click Finish.