Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a new Windows 2008 R2 Server (Standard, German). After installation from CD I enabled RDP Access, installed the Active Directory services and executed dcpromo. After reboot I log in via RDP as Domain Administrator and run Start -> Windows Security -> Change password. This does not work. What ever password I try, i get the error message that the password cannot be changed because of complexity restrictions.

I checked the policy using rsop.msc and everything seems normal. I tried passwords like "Asdf123", "P@ssword", "Letme1n." Which all should work.

I reinstalled several times. Same result. Please help, time is running out :(



The Domain Password policy also has a rule for the minimum age. This enforces that the password cannot be changed twice within one day. This rule does only apply for Domain Controller.

share|improve this question
What is your complexity policy set to? – t1nt1n Dec 31 '11 at 11:46
It's the default. Complexity requirements apply, History of 24 Passwords, reversible encryption disabled, max age 42 days, min length 7 characters, minimum age 1 day That's it. I did not realize that there is also a minimum age. Thx for asking! – Roman Dec 31 '11 at 12:15
@Thomas Please post your solution as an answer and mark it as accepted. – jscott Dec 31 '11 at 12:22
t1nt1n: Okay I haven' used the platform for a while. How shall I "answer" this question? If you want to write on, I'll accept it. – Roman Dec 31 '11 at 12:23
@Thomas use the "Your Answer" form below to post the Solution and then accept the answer – Mathias R. Jessen Dec 31 '11 at 12:57
up vote 3 down vote accepted

It turned out to be normal behavior inside a domain. The problem was the password policy "minimum password age" which defaults to 1 day. So all user accounts including the domain administrator cannot change their password within one day.

Of course the reset password function in Active Directory Users and Computers is still working. For non Domain Computers this restriction does not apply by default. In this case a password change should be possible at any time.

Thx to the commenters. Happy new year!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.