| Previous | Next |
| STATUS_LAST_ADMIN | STATUS_ILL_FORMED_PASSWORD |
STATUS_WRONG_PASSWORD
A credential mismatch, not always a typing mistake
STATUS_WRONG_PASSWORD is the more specific signal that the verifier rejected the supplied password or equivalent secret. It is frequently logged as a substatus beneath a generic logon failure. The immediate cause can be a stale saved password, a service account that was changed in one place but not another, or a client using the wrong account domain rather than a user simply typing the wrong characters.
For NTLMv2, the domain supplied by the client affects the password-derived calculation. Microsoft documents cases where a valid account/password combination fails when the source domain is empty or unknown to the server. That is why a credential prompt that accepts several name forms should be tested with an explicitly qualified account name rather than by changing the password first.
Focused checks
- Identify the exact process, scheduled task, mapped drive, service, or device repeatedly sending the credential.
- Verify the account namespace: local machine, Active Directory domain, UPN, or application-specific identity store.
- Remove obsolete stored credentials only after recording their owner and target; otherwise the original source can continue causing lockouts.
- For Kerberos paths, review Event 4771 on the domain controller and compare its result with the client-side failure.
References
- Microsoft Open Specifications: NTSTATUS reference
- Microsoft: network access validation algorithms
- Microsoft: Event 4771, Kerberos pre-authentication failed
Looking for a different code? Search another status or error code.