I know this error is infuriating—you type a perfectly good password and Windows spits back STATUS_PWD_TOO_SHORT without telling you the actual minimum length. The real fix is usually simpler than you think, so let's get to it.
First, try a longer password (but that's not the real fix)
If you're in a hurry, just add a few more characters and see if it goes through. But that's a band-aid. The error means your account's password policy requires a minimum length you haven't met, and the default in many corporate environments is 8 characters. However, even an 8-character password might still fail if the policy is set higher or if other complexity rules apply.
But honestly, you shouldn't have to guess. Here's how to find the actual requirement and make the error disappear for good.
The real fix: check and adjust the policy
For local accounts (standalone PC)
Open Command Prompt as Administrator. Right-click the Start button and pick "Command Prompt (Admin)" or "Windows PowerShell (Admin)". Then run:
net accountsLook for the line that says Minimum password length. That's your target. If it says 0, then the policy isn't the culprit—skip to the next section. If it's, say, 14, then you need to type at least 14 characters.
To change that minimum, run:
net accounts /minpwlen:8That sets the minimum to 8. You can pick any number between 0 and 14 (or 20 on some systems). Then try your password again.
For domain accounts (corporate or school PC)
Here's the kicker: if your computer is joined to a domain, you cannot change the policy locally. It's set by your IT admin via Group Policy. Trying net accounts will either fail or show the domain default, but you can't override it.
Your options are:
- Use a password that meets the domain minimum (ask IT or check the password change screen—some show requirements).
- Contact IT and ask them to reset the policy for your account or force a password reset.
- If you're an admin, you can edit the Group Policy on the domain controller. But that's dangerous—don't lower it for everyone just to fix one account.
In a domain, the error often appears when a user tries to set a password that's shorter than what the Enforce password history or Maximum password age settings indirectly force. But the most common culprit is Minimum password length being set high (like 15) and you trying to use 8.
Why this error happens (the technical bit)
Windows doesn't just check the length you type. It runs the password against the net accounts policy and the Local Security Policy. If you're on a domain, it checks the Default Domain Policy. The error code 0xC000025A specifically translates to STATUS_PWD_TOO_SHORT, which Windows throws when the password you entered doesn't meet the minimum length requirement—not complexity, not history, just length.
So if you've got a password that's 7 characters and the policy says 8, you get this exact error. And here's the annoying part: Windows often doesn't tell you the minimum on the change screen. You just see the generic "Password does not meet policy" message, or worse, a cryptic error like this one.
The root cause is usually a misconfigured policy—either someone set it too high or you're testing on a machine with a leftover domain policy from a previous network. I've seen it happen when a laptop was once domain-joined and still has cached policy settings that apply even after leaving the domain.
Less common variations of the same issue
When the error appears during installation or first login
Some users hit 0xC000025A during Windows Setup when creating the local admin account. That's because the setup process enforces a default policy that differs from your intended password. In that case, try a longer password (12+ characters) or temporarily set the policy using the pre-installation environment. But honestly, easiest is to just use a longer password.
When it happens in a script or remote PowerShell
If you're automating user creation with PowerShell and using Set-ADAccountPassword, you might see this error because the -Reset switch bypasses some checks but not the length. Double-check the password string in your script—I've seen bugs where a trailing space or hidden character truncates the length. Trim the string before setting it.
When it happens in a child domain
In a multi-domain forest, the password policy that applies is the domain policy of the user's domain, not the domain where the DC is running. If you're an admin in a parent domain trying to reset a password for a user in a child domain, you might hit this if the child domain has fine-grained password policies set. Use Get-ADUserResultantPasswordPolicy to check which policy applies.
Prevention: stop this from happening again
The best prevention is knowing your environment. For local machines, set a sane minimum length (8 or 10) and stick to it. For domains, make sure your Fine-Grained Password Policy is documented and communicated to users. And if you're a home user with a standalone PC, just remember that Windows' default net accounts policy might be different from what you expect—run net accounts once a month to check.
Also, if you're a developer or IT pro creating test accounts, get into the habit of checking the password policy before you write your provisioning script. Two minutes of checking saves you from debugging this error at 2 AM.
So, next time you see STATUS_PWD_TOO_SHORT, don't panic. Run net accounts, see the real number, and type a password that clears it. If you're on a domain, email IT and ask them to raise the minimum or reset your password. You've got this.