| Previous | Next |
| STATUS_ILL_FORMED_PASSWORD | STATUS_LOGON_FAILURE |
STATUS_PASSWORD_RESTRICTION
Why a new password can be refused
STATUS_PASSWORD_RESTRICTION is produced during a password update when the proposed value violates a rule that applies to the account. The code does not identify one universal rule. In a managed environment, the effective requirement can be influenced by domain policy, fine-grained policy, local policy, a directory or identity provider, and password-history or age controls. A value that works for one account or workstation can therefore be rejected for another.
This is different from STATUS_WRONG_PASSWORD: the current credential may be accepted, but the replacement is not eligible. It is also different from a password-expired sign-in, where the account may require an update before normal authentication can continue.
How to investigate without weakening policy
- Establish which directory or policy authority owns the account, then inspect the effective policy rather than only the local computer settings.
- Check password history, minimum age, length, banned-value or custom filter rules, and any identity-management workflow that may be enforcing additional conditions.
- Use the organisation’s approved password-reset channel; avoid lowering a domain policy to make one value acceptable.
- Record the policy source and the account scope, because they explain why identical user-facing prompts can produce different results.
References
- Microsoft Open Specifications: NTSTATUS reference
- MIT Kerberos: password management
- NIST SP 800-63B digital identity guidance
Looking for a different code? Search another status or error code.