Quick answer
Run net user <username> /domain to see the "Password can be changed" date. If it's in the future, you must wait or have an admin modify the Minimum password age policy in Group Policy or Active Directory.
Why you're seeing this error
The error 0X00000268 (ERROR_PWD_TOO_RECENT) is Windows's way of saying "You changed your password too recently — slow down." It's not broken. It's working exactly as configured.
What's actually happening here is that Windows enforces a minimum password age. This is a domain or local security policy setting that prevents users from cycling through passwords too fast. The logic? If you could change your password every five minutes, you'd just rotate through old favorites to bypass password history rules. Microsoft made this a requirement for password history to actually work — without a minimum age, you could change your password 20 times in an hour and land back on your original one.
You'll hit this most often in corporate environments on a domain, or after an admin forced a password reset and you immediately try to change it again. It can also pop up if you're testing password policies or using scripts that attempt password changes too quickly.
Step-by-step fix
Step 1: Check your current password age policy
Before doing anything, find out what the actual minimum age is. Open Command Prompt as admin and run:
net accounts /domainLook for Minimum password age (days). If it's set to 1, you need to wait at least one full day between changes. If you're not on a domain, drop the /domain flag.
To check your own account's "can change" date:
net user %username% /domainFind the line that says Password can be changed. That's the earliest date you can try again.
Step 2: Wait it out (boring but reliable)
If you're in a hurry, the clock is your only option unless you have admin rights. The countdown started the moment you last changed your password. No shortcuts.
Step 3: Change the policy (needs admin rights)
If you're a domain admin or local admin, you can lower the minimum age. This is the real fix for most people.
For a local machine (standalone Windows 10/11):
- Press
Win + R, typesecpol.msc, hit Enter. - Go to Account Policies > Password Policy.
- Double-click Minimum password age.
- Set it to 0 (zero) — this means users can change their password at any time.
- Click OK. No reboot needed.
For a domain environment (Active Directory):
- Open Group Policy Management Console (GPMC).
- Edit the Default Domain Policy or a linked GPO.
- Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy.
- Set Minimum password age to 0 (or a lower value like 1 day).
- Run
gpupdate /forceon the affected machine.
The reason step 3 works is that the policy check happens at logon and periodically via Group Policy refresh. Setting it to zero tells Windows "no minimum waiting period."
Step 4: Force a policy refresh
Even after changing the policy, your client might hold onto a cached version. Run this in an admin Command Prompt:
gpupdate /forceThen try the password change again.
Alternative fixes if the main one fails
Reset via another admin account
If you can't change the policy (not an admin), have a domain admin reset your password from Active Directory Users and Computers. A forced reset from the server side doesn't trigger the "too recent" check — that check only applies when the user initiates the change.
Use the old password one last time
This sounds backwards, but some users get stuck in a loop: they change password, forget it, get it reset by IT, then try to change it again immediately. If you still know the previous password, you can log in with that — but only if the admin reset moved you back to it. This is highly specific to your environment's password history settings.
Disable the policy entirely (not recommended)
Setting minimum password age to 0 effectively disables this check. It's fine for test machines or single-user setups, but on a domain it makes password history useless. Users can bypass history by cycling passwords rapidly.
Prevention tip
If you manage a domain, set the minimum password age to 1 day as a baseline. It stops rapid-fire password cycling (which defeats password history) without being a usability nightmare. For admin accounts, consider 0 days so you can change passwords immediately after a breach. The difference between 0 and 1 is huge — you can't even change a password twice in the same day with 1 day minimum, which is fine for 99% of users.