| Previous | Next |
| STATUS_PWD_TOO_SHORT | STATUS_PWD_HISTORY_CONFLICT |
STATUS_PWD_TOO_RECENT
Minimum password age is a change-frequency control, not password expiration
STATUS_PWD_TOO_RECENT means the current password has not been in use long enough to permit another ordinary user-initiated change under the effective policy. Windows documents Minimum password age as the number of days a password must be used before the user can change it. This is separate from Maximum password age, which controls expiration.
The policy is commonly paired with password history so a user cannot rapidly cycle through enough values to reuse an old password. For domain accounts, a fine-grained password policy can produce a different minimum age for one user or group. Check the resultant policy and the recorded password-change time rather than assuming the Default Domain Policy is the only source.
If compromise is suspected, do not tell the user to wait for the timer. Use the organization’s administrative reset or incident-response path, because Microsoft explicitly distinguishes help-desk/administrator intervention from ordinary user changes subject to minimum age. Also investigate automation loops that repeatedly call a change API after a successful rotation and immediately trigger this status.
What to inspect
- The effective Minimum password age for the account and the time of the last successful password set or change.
- Whether the operation is a user change, administrative reset, synchronization action, or repeated provisioning workflow.
- The applicable fine-grained policy and any recent policy change that altered minimum-age behavior.
References
- Microsoft: Minimum password age policy
- Microsoft: Fine-grained password policies for AD DS
- Microsoft: Enforce password history policy
- Microsoft: Windows password policy settings
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.