I got the following message trying to RDP to a Windows Server 2012 R2. However I can't get a prompt or anything to change the password. Is this due to NLA (network-level authentication) or could it be something else?

This user account's password has expired. The password must change in order to logon. Please update the password or contact your system administrator or technical support.


  • 1
    Are you the system administrator or technical support? – Xavierjazz Sep 29 '16 at 20:16
  • 1
    No but I would still like to know what setting/configuration causes this. @Xavierjazz – Ogglas Sep 29 '16 at 21:17

I was able to get the password changed after I added this row:


temporarily to my default.rdp file c:\users\[username]\documents. This changed the situation so that the authentication happened in server side, and the the server was able to show the dialog for giving the new password.

  • Does not seem to work with Server 2k12 R2. – JustAGuy Mar 3 '19 at 19:29
  • Server. Client being Win10. – JustAGuy Mar 4 '19 at 15:06
  • Did you get an error saying something like remote computer requires network level authentication which your computer does not support? – James Z Mar 5 '19 at 13:26
  • I actually did. – JustAGuy Mar 5 '19 at 13:31
  • Had a chance to test this only really quickly, but it looks like that "Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended)" link in the server side prevents this. Not really my area of expertise, so there might be something else related to this too. – James Z Mar 5 '19 at 17:35

I do not believe mismatched NLA would affect an RDP connection in this way. I've only seen that effect when trying to authenticate shares and the like.

Are you getting the error once you're at the logon screen on the remote server, or from the RDP credentials dialog on your local screen?

One possible reason could be that the account is configured not to allow the user to change their own password. I've seen this configuration several times in environments where smart cards logins are only partially implemented. Users are configured to allow smart card authentication, but not require it. So, there is a password associated with the account, but the user has no knowledge of (or control over in some cases) the password - which may or may not have been reset as a part of the smart card implementation.

  • Little bit late but I just got this error when trying to log using RDP into server in a different domain, and this happens on the local screen. – James Z Mar 30 '17 at 9:20
  • Are you providing a password on the local RDP connection screen before you get to the remote servers login screen? If so, they error is likely still about the account in the domain for the remote server or local account on the remote server. In that case you can try not providing a password on the local RDP screen before making the connection and then provide the user name and password on the remote servers login screen (if security configuration allows it). Then you might be allowed to change the password on the remote server's login screen. – David Woodward Mar 31 '17 at 1:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.