| Previous | Next |
| ERROR_LOGON_TYPE_NOT_GRANTED | ERROR_NO_SUCH_MEMBER |
ERROR_NT_CROSS_ENCRYPTION_REQUIRED
The legacy password-change request is missing NT cross-encryption data
SamrChangePasswordUser carries several password-hash values encrypted under other old or new password representations. Its parameters include NtCrossEncryptionPresent and NewNtEncryptedWithNewLm as well as the corresponding LM cross-encryption fields. ERROR_NT_CROSS_ENCRYPTION_REQUIRED belongs to this legacy protocol contract: the server requires the NT cross-encrypted component for the password-change combination being submitted.
Inspect the SAMR method and marshalling logic rather than asking the user to invent a more complex password. The failure indicates that the request lacks required protocol material. Modern clients should prefer current password-change interfaces; code that manually implements the legacy method must calculate the documented OWF-password encryption fields consistently and set the presence flags to match the supplied buffers.
What to inspect
- Capture the exact SAMR password-change method and presence flags.
- Verify NT and LM cross-encrypted fields are generated from the same old/new password pair.
- Do not treat the result as a domain password-policy rejection.
References
Looking for a different code? Search another status or error code.