Fix 0XC000006C: STATUS_PASSWORD_RESTRICTION in 5 Minutes

You're locked out — let's get you back in

Getting the STATUS_PASSWORD_RESTRICTION error (0XC000006C) is maddening, especially when you're stuck at a login screen. The culprit here is almost always a password that doesn't meet your domain or local group policy — complexity rules, history restrictions, or minimum length. Here's the fix, step by step.

Step 1: Boot into Safe Mode with Command Prompt

1. Restart your PC and press F8 (or hold Shift + click Restart in Windows 10/11) to get to Advanced Boot Options.
2. Select Safe Mode with Command Prompt.
3. Log in as the built-in Administrator account (if it's not visible, you may need to enable it first — see below).

If you're on a domain-joined machine and can't see the local admin account, press Ctrl+Alt+Del twice at the login screen to bring up the classic login box. Type .\Administrator as the username. Leave the password blank if it's never been set.

Step 2: Reset the user's password

Once you're in the command prompt, run:

net user username NewPassword123! /domain

Replace username with the actual account name. If it's a local account, drop the /domain flag. The password NewPassword123! should meet typical complexity rules (uppercase, lowercase, number, special char).

If the domain controller is unreachable (common when the machine is offline and cached credentials are failing), force a local reset:

net user username NewPassword123!

This bypasses domain policy entirely and sets a local password. You'll need to rejoin the domain afterward if this was a domain account.

Step 3: Bypass password history restrictions

If the user has changed passwords too many times recently, Windows may reject a new one that matches a recent password. Use this one-liner to clear the password history for a local user:

net user username /passwordchg:yes

Then set the password again. For domain accounts, you need to modify the Active Directory pwdLastSet attribute — but that's usually done from the domain controller side (see prevention section).

Why this works

The error 0XC000006C maps to STATUS_PASSWORD_RESTRICTION. Windows throws it when the password you're trying to set violates one of these rules:

• Minimum password length (default 8 chars in most domains)
• Password complexity (must include 3 of 4: upper, lower, digit, symbol)
• Password history (can't reuse one of the last 24 passwords)
• Password minimum age (can't change it again until X days)

Safe mode with command prompt gives you access to the local Administrator account, which can bypass the current user's restrictions. The net user command is a raw way to set a password without going through the GUI's policy checks — though it still respects the local machine's policy if you're not using the domain controller.

I've seen this happen most often when:

• A user is on a laptop that's been offline for weeks, and the cached password expires
• An admin force-changed a password via ADUC but didn't meet the domain's complexity rules
• Someone tried to reuse a password that's still in the history

Less common variations of the same issue

1. The built-in Administrator account is disabled

On Windows 10/11 Pro and Enterprise, the local Administrator is often disabled by default. If you can't log in via safe mode, enable it from the recovery environment:

net user administrator /active:yes

Then set a password for it and try again.

2. Domain controller rejection (0XC000006C on login)

If the error pops up when logging into a domain-joined machine, not when changing a password, it's usually because the cached credentials on the local machine conflict with the domain policy. The fix is to disconnect from the network, log in with cached credentials (if they still work), and then reconnect. If cached creds are also expired, use the local admin reset above.

3. Password expiration notice before login

Sometimes you see 0XC000006C when Windows tries to prompt you to change your password at next login, but the new password you enter fails policy. The workaround: press Ctrl+Alt+Del, click Change a password, and enter the old password once, then a new one that meets complexity. If that fails, do the safe mode reset.

Prevention: stop this from coming back

You've fixed it once — now lock it down so it doesn't happen again. Here's what I do at every client:

• Check Group Policy — Run gpresult /h gp.html on a working client and look at the password policy section. Common culprits: Minimum password length set too high, Password must meet complexity requirements enabled without exceptions.
• Adjust password history — If users frequently rotate passwords, set Enforce password history to 8 or 10 instead of the default 24. Domain controllers can handle it, but users won't get locked out.
• Use a password manager — Honestly, 90% of these errors come from people trying to use the same weak password. Deploy a corporate password manager like Bitwarden or KeePass. Generates complex passwords that pass policy every time.
• Audit AD accounts — Run a PowerShell script weekly that reports accounts about to expire or with weak passwords. Catch issues before they become lockouts.

One final tip: if you're the admin and you keep seeing this error when bulk-resetting user passwords, you're probably forgetting the /domain flag on net user. Without it, the command runs against the local SAM, which has its own policy — often less strict than the domain's. That mismatch causes the error. Always use /domain when targeting domain accounts.

That's it. You're back in, and you know exactly why it happened. Now go update that GPO.