| Previous | Next |
| STATUS_LICENSE_QUOTA_EXCEEDED | STATUS_PWD_TOO_RECENT |
STATUS_PWD_TOO_SHORT
Inspect the resultant policy for this account, not a generic password prompt
STATUS_PWD_TOO_SHORT narrows a general password-restriction failure to length. In Active Directory, fine-grained password policies can define different settings for different users or global security groups within one domain. The policy visible in a generic local security dialog may therefore not be the resultant policy applied to the affected domain account.
Determine the account authority first, then inspect the effective minimum length and any identity-management layer that changes passwords on the account’s behalf. Count the proposed value as the receiving system does; do not infer compliance from the number of visible glyphs in a UI that may normalize or transform input before it reaches the password API.
The correct response is to choose a value that satisfies the effective policy or correct an incorrectly scoped policy. Lowering a domain-wide minimum to accommodate one legacy application changes security for many accounts. If an application truncates passwords before submission, capture the length at the API boundary and fix that application rather than weakening policy.
What to inspect
- The account store and the resultant password policy applied to the specific user, including fine-grained policy precedence.
- The length of the password value at the password-change API boundary, without logging the secret itself.
- Legacy clients, connectors, or provisioning systems that may impose their own shorter field or truncate input.
References
- Microsoft: Fine-grained password policies for AD DS
- Microsoft: Minimum password length policy
- Microsoft: Windows password policy settings
- NIST SP 800-63B: Password guidance
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.