Fix 0X00000A90 password not complex enough error

Error 0X00000A90 means Windows says your password isn't complex enough, but you already added symbols and numbers. The real fix is often a quick policy tweak or a pass-the-hash workaround.

What you're dealing with

You're trying to change a password—maybe your own, maybe for another user—and Windows throws back error 0X00000A90. The message says something like "The password does not meet the password complexity policy." But you already added uppercase, numbers, maybe even a symbol. What gives?

This error comes from NERR_PasswordNotComplexEnough, a Windows networking error buried in the system. It usually shows up when you use the Net User command in a command prompt or when Active Directory enforces strict password rules. But sometimes the policy check misfires—especially on domain-connected machines or when you're running older Windows versions like Server 2012 R2 or Windows 10 1809.

Let's walk through the fixes. Start with the quick one, then move up if you need to.

Fix 1: The 30-second check — your password really needs to be complex

Before you dig into registry edits, make sure your password actually meets the standard complexity rules. Windows requires at least three of these four character types:

Uppercase letters (A-Z)
Lowercase letters (a-z)
Numbers (0-9)
Special characters like ! @ # $ % ^ & *

Critical rule that trips people up: The password must not contain your username or any part of your full name. If your username is "jsmith," a password like "Smith2024!" will fail—even though it has uppercase, lowercase, and a symbol—because it contains "Smith."

Try a password like G3tTh!sD0ne (that's 12 characters, mixes numbers and symbols, no username). If that works, you're done. If not, move on.

Fix 2: The 5-minute fix — bypass the policy with Net Accounts

Sometimes the local password policy gets out of sync with what the system actually checks. You can reset the policy for the local machine without touching Group Policy.

Open Command Prompt as Administrator. Type cmd in the Start menu, right-click "Command Prompt," choose "Run as administrator."
Type this command and press Enter:
net accounts /minpwlen:0
This sets the minimum password length to 0 characters (temporarily). You should see "The command completed successfully."
Now try setting your password again with the same password you wanted before. If that works, great.
Set the minimum length back to something reasonable:
net accounts /minpwlen:8

This trick works because net accounts overrides the local policy for the current session. It's a dirty fix, but it's fast. If the error persists, your domain policy is the real issue—skip to Fix 3.

Fix 3: The 15-minute fix — edit Group Policy or registry

This is for domain-joined computers or servers where the policy is enforced by Active Directory. You have two routes:

Route A: Group Policy Editor (if you have access)

Press Win + R, type gpedit.msc, hit Enter.
Go to Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy.
Double-click Password must meet complexity requirements.
Set it to Disabled. Click Apply, then OK.
In the same window, set Minimum password length to 0 (zero) if you want to bypass length checks too.
Close the editor. Open a command prompt and run gpupdate /force to apply the change immediately.

Expect this: After you run gpupdate, you'll see "Computer Policy update has completed successfully." Now try your password change again.

Route B: Registry edit (when Group Policy is blocked)

If you don't have gpedit.msc (common on Windows Home editions or locked-down workstations), you can tweak the registry directly. Back up your registry first—seriously, don't skip this.

Press Win + R, type regedit, hit Enter.
Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Find the value named NoPasswordComplexity. If it's not there, right-click an empty space, choose New > DWORD (32-bit) Value, name it NoPasswordComplexity.
Double-click it, set the value to 1. Click OK.
Close Regedit. Reboot the machine (or restart the NetLogon service with net stop netlogon && net start netlogon in Command Prompt as Admin).

What you'll see after reboot: The password complexity requirement is now disabled. You can set any password—no symbols, no uppercase required. But remember: this lowers security. Only do this on isolated test machines or when you absolutely must get past a broken policy check.

When none of these work

If you're on a domain and your network admin has enforced password complexity at the domain level, local changes won't override it. You'll need to contact your IT admin and ask them to temporarily disable the policy for your account, or issue you a password that meets the domain rules.

Another sneaky cause: the password history setting. If you're reusing a password you've used in the last 24 passwords, Windows rejects it even if it's complex. Use a completely new password you've never used before.

One last trick: try changing the password through Active Directory Users and Computers (dsa.msc) if you're an admin. Right-click the user, choose "Reset Password," uncheck "User must change password at next logon." This sometimes bypasses the local policy check entirely.