Fix 0XC0000224: Password Must Change Before Login on RDP

You're stuck at login with STATUS_PASSWORD_MUST_CHANGE. Happens after admin resets your password or on first-time RDP. Quick fix: change password or tell AD to skip the check.

Quick answer

If you see 0XC0000224 (STATUS_PASSWORD_MUST_CHANGE) and can't log in, either change the password via a console session (not RDP) or uncheck User must change password at next logon in Active Directory Users and Computers.

Why this happens

Windows does this when an admin sets the User must change password at next logon flag in Active Directory or local user properties. The problem is: Remote Desktop Protocol (RDP) blocks login until you change the password. But you can't change it through RDP because Windows forces the old password first – circular catch-22.

This happens a lot after an admin resets a forgotten password, adds a new employee, or restores an old account. The system wants the user to set their own password before doing anything else. Makes sense for security, but sucks when you're remote.

Log in via console or VPN to the same network
Use a physical machine, or connect via a remote KVM, or use mstsc /admin (admin session) on older Windows versions. Once you're in, Windows will force the password change prompt. Put in the temporary password, then type a new one twice. Done.
If you can't get a console session, use net user from an admin CMD
On the server itself, open Command Prompt as admin and run:
```
net user username * /logonpasswordchg:no
```
Replace username with the actual login name. This kills the "must change" flag. After that, you can log in with the existing password (no change needed).
AD users: clear the flag from another admin machine
Open Active Directory Users and Computers. Find the user, right-click → Properties → Account tab. Uncheck User must change password at next logon. Click OK. Now the password stays what it is.
Local users (standalone PC): use lusrmgr.msc
Press Win+R, type lusrmgr.msc. Go to Users, double-click the account, uncheck User must change password at next logon. Hit OK.

Alternative fix: allow RDP password change

If you really want the user to change the password via RDP, you can enable Allow logon through Remote Desktop Services in Group Policy. But standard RDP still blocks it. The real workaround is to enable Network Level Authentication and use a VPN – still no guarantee. I'd just do step 1 or 2.

Why step 2 works

net user with /logonpasswordchg:no directly modifies the account's USER_FLAGS in the SAM (local) or AD database. That flag is the one Windows checks when you try to log in. Clear it, and the system doesn't ask for a password change.

Prevent it from happening again

When creating users, don't check "User must change password at next logon" unless you're sure they'll log in locally first.
For remote workers, send them a password and uncheck the flag. They can change it later via Ctrl+Alt+End inside RDP after logging in.
If you use a script to create users, set the flag to false explicitly. Example PowerShell for AD:
```
Set-ADUser username -ChangePasswordAtLogon $false
```

One more thing: If you get error 0XC0000224 during Windows Setup or after a sysprep, it's usually because the built-in Administrator account has the flag set. Use net user Administrator /logonpasswordchg:no before sysprep. That saves headaches later.

The bottom line: this error is Microsoft's way of forcing you to change a password. It's annoying because RDP blocks it. But you've got three solid ways around it. Pick one and move on.