| Previous | Next |
| ERROR_NTLM_BLOCKED | ERROR_LOST_MODE_LOGON_RESTRICTION |
ERROR_PASSWORD_CHANGE_REQUIRED
EAS policy requires the user to change the password first.
ERROR_PASSWORD_CHANGE_REQUIRED is Win32 error 1938 (0x792). Its system text specifically attributes the denial to an Exchange ActiveSync (EAS) policy. The account is not merely using a wrong password: policy marks password change as a prerequisite before the protected operation can continue.
Situations that trigger the requirement
- a password age, complexity, history, or administrative reset rule requires the next interactive change
- a device receives updated EAS compliance policy and has not completed the required credential transition
- a non-interactive client cannot present the password-change workflow expected by the account provider
- cached credentials or tokens survive after the account has entered a must-change state
- the device is offline from the authority needed to complete and confirm the new password
Useful support evidence
Record the account identifier after safe redaction, device enrollment ID, EAS policy version and sync time, operation attempted, interactive versus background client, connectivity to the identity/mail service, and policy/compliance events. Never log old or new passwords, password hints, tokens, or EAS provisioning secrets. Distinguish server-side must-change state from a local UI validation failure.
How to confirm the cause
Check account and device policy status through the authoritative management systems. Determine whether the user can complete a supported interactive password change and whether all devices know the updated credential. Inspect policy synchronization rather than repeatedly deleting and re-adding the account.
If the failing component is a service or background task, verify whether that flow is allowed to handle password expiration. A headless retry cannot satisfy a policy requiring user interaction; it should surface a clear remediation state.
Recovery
Have the user change the password through an approved online flow, then update dependent devices and applications without exposing the credential. Re-establish tokens or sessions as documented after the change. If policy is incorrect, fix assignment centrally rather than weakening the device locally.
Clients should stop automatic retries, present a specific password-change action, and preserve unsent work. Administrators should investigate recurring immediate requirements as policy synchronization or account-lifecycle problems.
Difference from ERROR_PASSWORD_MUST_CHANGE
ERROR_PASSWORD_MUST_CHANGE is a general pre-logon password-change requirement. Error 1938 explicitly identifies EAS policy as the source and often appears in managed mobile or mail-account workflows.
Example
A managed tablet continues background mail synchronization after an administrator marks the user password for change. The sync path receives 1938. The user completes the approved password-change flow and reauthenticates the account; repeated background sync alone could not clear the condition.
References
- Microsoft: System Error Codes (1700–3999)
- Microsoft: Win32 Error Codes in MS-ERREF
- Microsoft: Exchange ActiveSync Provisioning protocol
Looking for a different code? Search another status or error code.