lsadump::changentlm can be used to change the password of a user. It accepts either a clear-text password or an NT hash. According to Benjamin this option avoids the "setpassword" event but it requires to know the previous password or NT hash. It has the following command line arguments:/newpassword: The new clear text password for the target user/oldpassword : The existing clear text password to change/user: the target user account/oldntlm or /old : The existing NT hash to change/newntlm or /new : The new NT hash for the target user/server: The domain controller FQDNlsadump::changentlm. According to this issue on mimikatz's Github, a user cannot change his password more than one per day.