Ключевой момент:
Starting with lsadump::changentlm, this feature is similar to when a user changes their own password. You must either know the user’s original password or NTLM hash, and then you can set a new password (or NTLM hash) for the account. A few things to note though, you are restricted to any password complexity and minimum password age requirements set by the domain.
The second feature, lsadump::setntlm, acts similarly to the ‘set user password’ in ‘active directory users and computers.’ You need privileged access over the desired account, but you do not need to know the original password. You are also not restricted by any password complexity or minimum password age requirements.
What is important to note is that with both features, you can set/change the user’s password OR NTLM hash. (You can use Rubeus to generate a valid NTLM hash: Rubeus.exe hash /password:myawesomepassword.)