| Previous | Next |
| ERROR_TOO_MANY_SIDS | ERROR_NO_INHERITANCE |
ERROR_LM_CROSS_ENCRYPTION_REQUIRED
The legacy password-change request is missing LM cross-encryption data
SamrChangePasswordUser includes an LmCrossEncryptionPresent flag and a NewLmEncryptedWithNewNt field in addition to the NT-password fields. ERROR_LM_CROSS_ENCRYPTION_REQUIRED indicates that the password-change request needs that LM cross-encrypted component for the legacy combination being processed. This is a protocol-construction error, not a generic “password too weak” result.
Identify why the application is using the legacy change method and whether it actually has an LM representation for the new password. LM hashes are obsolete and Windows can be configured not to store them. Do not enable LM-hash storage system-wide merely to hide a broken custom client. If legacy interoperability is unavoidable, implement the exact SAMR cross-encryption contract and presence flags documented for the method.
What to inspect
- Inspect LmCrossEncryptionPresent and the corresponding cross-encrypted buffer.
- Check whether an LM password representation exists and whether policy disables LM-hash storage.
- Prefer a modern password-change API instead of weakening system policy for an obsolete client.
References
Looking for a different code? Search another status or error code.