| Previous | Next |
| ERROR_INVALID_PRINTER_STATE | ERROR_DOMAIN_CONTROLLER_NOT_FOUND |
ERROR_PASSWORD_MUST_CHANGE
The account password must be changed at the next sign-in.
ERROR_PASSWORD_MUST_CHANGE is Win32 error 1907 (0x773). The account is valid, but directory or local account state marks the current password as temporary or expired in a way that requires an interactive password-change workflow. Services and noninteractive protocols often cannot complete that workflow themselves.
Why the change requirement appears
- an administrator created or reset the account and selected “must change password at next logon”
- password age policy expired the current password
- a provisioning system left a temporary credential active after onboarding
- a user changed the password on one device but a cached or saved credential is still attempted elsewhere
- an application uses a logon type that cannot present the required password-change exchange
Account-state evidence to capture
Record the account and domain after redaction, authentication package, logon type, target service, password-last-set timestamp, relevant account-control flags, policy age values, and Security or domain-controller event IDs. Never record the old password, temporary password, new password, or challenge responses. Distinguish this status from wrong-password attempts so automated lockout protection behaves correctly.
How to confirm the requirement
Query account state through supported directory or local-account tools and verify that the correct domain controller is being used. Attempt the documented interactive password-change flow rather than repeatedly retrying the original service logon. Check whether the user can reach a controller and whether the new password satisfies current policy.
For services, scheduled tasks, and application pools, determine whether the identity should use a managed service account instead of a rotating human password. After a successful change, locate saved credentials and dependent services that still hold the old value.
Recovery and operational guidance
Have the user change the password through a trusted Windows, directory, or organization-approved self-service flow, then update authorized stored credentials. Administrators can reset the password when required, but should not clear the change flag merely to preserve a known temporary secret.
Applications should surface a specific “password change required” path and avoid treating 1907 as generic authentication failure. Unattended components should not run under accounts that require interactive password changes.
Difference from an expired or locked account
An expired account may no longer be permitted to authenticate at all, and ERROR_ACCOUNT_LOCKED_OUT indicates lockout after policy conditions. Error 1907 specifically requires replacing the current password before normal sign-in can proceed.
Example
A help desk resets a new employee’s password and marks it temporary. The employee’s VPN client receives 1907 because it cannot complete the change exchange. Signing in through the approved password portal, changing the temporary password, and then reconnecting resolves the issue.
References
- Microsoft: System Error Codes (1700–3999)
- Microsoft: Win32 Error Codes in MS-ERREF
- Microsoft: NetUserChangePassword
- Microsoft: User must change password at next logon
Looking for a different code? Search another status or error code.