| Previous | Next |
| STATUS_CLIENT_SERVER_PARAMETERS_INVALID | STATUS_NOT_FOUND |
STATUS_PASSWORD_MUST_CHANGE
Mandatory change versus ordinary expiry
STATUS_PASSWORD_MUST_CHANGE denotes an account state in which the password must be updated before normal access can proceed. It often follows an administrator-issued initial or reset password, but the exact trigger depends on the directory policy. The key operational point is that the authentication flow may need to permit a password-change transaction instead of a normal desktop, network-share, service or API logon.
This status is close to password expiry but is not merely a warning. An automated client that has no interactive password-change capability will continue to fail until the identity is changed through an approved management path. Reusing the old credential, adding retry loops, or changing unrelated access permissions cannot satisfy the account-state requirement.
What administrators and application owners should check
- Determine whether the account is human-operated or non-interactive; service identities need a controlled replacement process rather than an interactive prompt.
- Confirm the reset/change workflow and whether it can reach the same directory authority that evaluated the logon.
- Update dependencies after the change, including services, scheduled tasks, application secrets and stored credentials.
- Check that a forced-change rule is intentional for the account class; do not remove it blindly to restore one workload.
References
- Microsoft Open Specifications: NTSTATUS reference
- MIT Kerberos: password management
- NIST SP 800-63B digital identity guidance
Looking for a different code? Search another status or error code.