Password is incorrect when "User must change password at next logon" box is checked

Question

I've run into an odd issue, whenever I go to reset someone's password on the domain controller, and the "User must change password at next logon" box is checked, that password will not work. But when I uncheck the box the password does work. This is a very concerning issue because this makes it a lot harder for users to change passwords. I'm currently running Windows Server 2022.

Answer 1

What is the current patch level? I remember some issues with March update and password change loop issues. May need to patch it fully.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

There could be some issue or latency between server? You could check

Get-ADUser -Identity username -Properties * -Server DC01 | Select PasswordLastSet  

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

Hello

Thank you for your question and reaching out.

-Please check Group Policy for "Minimum Password Age". It may be overriding the attempts to change the password.

-Please check that AD replication is Good across all Domain controllers.

Another reason may be if you configure this setting and the user is prompted to change their password, replication latency may cause the user to receive a message that states that their old password is incorrect after they type their old password.

Reference :

https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/user-must-change-password-at-next-logon-setting

--If the reply is helpful, please Upvote and Accept as answer--