| Previous | Next |
| EAS_E_ADMINS_CANNOT_CHANGE_PASSWORD | EAS_E_PASSWORD_POLICY_NOT_ENFORCEABLE_FOR_CONNECTED_ADMINS |
EAS_E_LOCAL_CONTROLLED_USERS_CANNOT_CHANGE_PASSWORD
EAS_E_LOCAL_CONTROLLED_USERS_CANNOT_CHANGE_PASSWORD — 0x80550009
EAS_E_LOCAL_CONTROLLED_USERS_CANNOT_CHANGE_PASSWORD means that one or more local standard users controlled by EAS policy cannot perform the password change needed for compliance.
What the status narrows down
This code targets local controlled standard users, not all accounts on the machine.
Evidence worth preserving
- Control-user account list tied to configured EAS mail apps
- Per-account password-change restriction and enabled state
- Requested password policies and pending actions
- Difference between local, domain, and Microsoft accounts
Collect the smallest evidence set that identifies the attempt and object. Redact secrets and message contents; preserve hashes, IDs, policy values, versions, and state transitions instead.
A controlled diagnostic sequence
- Remove the restriction from one disposable standard account.
- Unlink the test EAS account and confirm policy scope changes as expected.
- Run CheckCompliance from each relevant user context.
Correction and proof
A defensible correction is specific to the evidence: Restore password-change capability for affected local users or change account/policy design through the proper authority.
Close the incident only when each controlled user can satisfy the policy without administrator credential disclosure and unaffected users remain outside scope.
Technical references
The details above are grounded in the following Microsoft specifications and API documentation:
Looking for a different code? Search another status or error code.