| Previous | Next |
| ERROR_ILL_FORMED_PASSWORD | ERROR_LOGON_FAILURE |
ERROR_PASSWORD_RESTRICTION
The new password violates an account or domain password-policy rule
Windows password policy can enforce minimum length, history, minimum age and complexity, and Active Directory can apply fine-grained password policy to selected users or groups. ERROR_PASSWORD_RESTRICTION is the aggregate policy failure returned by account-management APIs when the proposed password does not satisfy the effective rules. It is not equivalent to ERROR_WRONG_PASSWORD, which concerns the current credential.
Query the effective account/domain policy rather than guessing which character to add. NetUserModalsGet exposes global user-policy information, SAMR has domain password-information methods, and NetValidatePasswordPolicy can validate password-policy behavior for supported scenarios. If a domain account is subject to a fine-grained policy, the effective rules can differ from the default domain policy.
What to inspect
- Check minimum length, history, complexity and minimum password age.
- Determine whether a fine-grained password policy applies to the account.
- Keep the server-returned policy status and target domain in diagnostics; do not log the proposed password.
References
Looking for a different code? Search another status or error code.