Fix 0X00000A8D: Password Must Change at Next Logon

Yeah, that error's a pain — you're staring at a login screen that won't let you in. But the fix is dead simple. Your password expired, and Windows is forcing you to change it before you can do anything else.

The Quick Fix

On the locked login screen, press CTRL + ALT + DEL. If you're on a remote desktop session, use CTRL + ALT + END. That should pop up a password change dialog. Enter your old password, then a new one that meets your domain's complexity rules. Done.

If that doesn't work — and it sometimes doesn't on locked workstations — you'll need to do this from another machine or via command line.

Open a command prompt as administrator on the same network.
Run:
```
net user username newpassword /domain
```
Then clear the "must change" flag:
```
net user username /logonpasswordchg:no
```

Replace username with the actual username and newpassword with something secure. The /logonpasswordchg:no switch tells the domain controller to stop requiring a change at next logon.

Why This Happens

The error code 0X00000A8D maps to NERR_PasswordMustChange — it's a Windows NT status code. Your domain account has the "User must change password at next logon" flag set, and the password already expired. Windows blocks the logon because it can't prompt you to change it in the current session state. Happens all the time after password policy changes, new account creation, or forced resets by admins.

The culprit here is almost always the /logonpasswordchg:yes flag combined with an expired password. If an admin or a script set that flag and the password grace period lapsed, you're stuck until someone clears it.

Less Common Variations

Sometimes you'll see this error on Windows Server 2012 R2 or older after a domain functional level upgrade. The old server holds a cached credential that's out of sync with the new policy. In that case:

Try logging in locally as a different user (like a local admin) and running gpupdate /force.
Then use net user username /domain to verify the account flags.
If the account shows Password expired as True, reset it with net user username * /domain (it'll prompt for a new password).

Another odd one: if you're using a Microsoft Account (like a personal Outlook.com account) on a domain-joined machine, the error can pop up if the cached Microsoft token expired. That's rare but I've seen it. Fix is to sign out of the Microsoft account via Settings > Accounts > Your info, then sign back in.

Prevention

Don't let your password expire. Set a calendar reminder for a week before the domain's max password age (usually 42 or 90 days). If you're an admin, never use the /logonpasswordchg:yes flag unless you're sure the user can change it immediately. Script it with a prompt so they get notified ahead of time.

Quick tip: If you're deploying new user accounts, set a temporary password with /logonpasswordchg:yes but also force a password change notification via email. Saves you a help desk ticket every time.

Also, check your domain password policy. If the minimum password age is set to 0, users can change it right back to the old one. That defeats the purpose. Set minimum age to 1 day at least.

Still Stuck?

If you can't get in and don't have admin rights on another machine, call your help desk. They can reset your password and clear the flag in Active Directory Users and Computers. Takes 30 seconds. Don't try to crack your own machine — you'll just lock the account.