diff --git a/rancher2/resource_rancher2_user_test.go b/rancher2/resource_rancher2_user_test.go
index 47ed8113..09f5a2e7 100644
--- a/rancher2/resource_rancher2_user_test.go
+++ b/rancher2/resource_rancher2_user_test.go
@@ -15,8 +15,9 @@ const (
 )
 
 var (
-	testAccRancher2User       string
-	testAccRancher2UserUpdate string
+	testAccRancher2User                    string
+	testAccRancher2UserUpdate              string
+	testAccRancher2UserUpdatePasswordReset string
 )
 
 func init() {
@@ -38,6 +39,16 @@ resource "` + testAccRancher2UserType + `" "foo" {
   must_change_password = true
 }
  `
+
+	testAccRancher2UserUpdatePasswordReset = `
+ resource "` + testAccRancher2UserType + `" "foo" {
+   name = "Terraform user acceptance test - Updated"
+   username = "foo"
+   password = "TestACC1234567"
+   enabled = true
+   must_change_password = false 
+ }
+  `
 }
 
 func TestAccRancher2User_basic(t *testing.T) {
@@ -81,6 +92,47 @@ func TestAccRancher2User_basic(t *testing.T) {
 	})
 }
 
+func TestAccRancher2User_passwordReset(t *testing.T) {
+	var user *managementClient.User
+
+	resource.Test(t, resource.TestCase{
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckRancher2UserDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccRancher2User,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRancher2UserExists(testAccRancher2UserType+".foo", user),
+					resource.TestCheckResourceAttr(testAccRancher2UserType+".foo", "name", "Terraform user acceptance test"),
+					resource.TestCheckResourceAttr(testAccRancher2UserType+".foo", "password", "TestACC123456"),
+					resource.TestCheckResourceAttr(testAccRancher2UserType+".foo", "enabled", "true"),
+					resource.TestCheckResourceAttr(testAccRancher2UserType+".foo", "must_change_password", "true"),
+				),
+			},
+			{
+				Config: testAccRancher2UserUpdatePasswordReset,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRancher2UserExists(testAccRancher2UserType+".foo", user),
+					resource.TestCheckResourceAttr(testAccRancher2UserType+".foo", "name", "Terraform user acceptance test - Updated (password reset)"),
+					resource.TestCheckResourceAttr(testAccRancher2UserType+".foo", "password", "TestACC1234567"),
+					resource.TestCheckResourceAttr(testAccRancher2UserType+".foo", "enabled", "true"),
+					resource.TestCheckResourceAttr(testAccRancher2UserType+".foo", "must_change_password", "false"),
+				),
+			},
+			{
+				Config: testAccRancher2User,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckRancher2UserExists(testAccRancher2UserType+".foo", user),
+					resource.TestCheckResourceAttr(testAccRancher2UserType+".foo", "name", "Terraform user acceptance test"),
+					resource.TestCheckResourceAttr(testAccRancher2UserType+".foo", "password", "TestACC123456"),
+					resource.TestCheckResourceAttr(testAccRancher2UserType+".foo", "enabled", "true"),
+					resource.TestCheckResourceAttr(testAccRancher2UserType+".foo", "must_change_password", "true"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccRancher2User_disappears(t *testing.T) {
 	var user *managementClient.User