A user tries to change his/her password in a Windows domain and it's not accepted:

The password supplied does not meet the minimum complexity requirements

How can an end-user find out what the requirements are? (The obvious solution would be to contact IT but let's say it's not possible)

  • If there is an AD in place, who manages it and why can't they be contacted?
    – Dave M
    Commented Dec 6, 2011 at 15:23
  • 2
    @Dave: it's a theoretical question :) I'm just curious if it can be done
    – Siim K
    Commented Dec 6, 2011 at 15:26
  • 9
    Not always so theoretical, having been trying to help an end user with this exact problem when the sysadmin was on vacation... It's a pretty big design flaw that Windows doesn't tell the user what the complexity requirements are during the password change process. Commented Aug 28, 2014 at 15:01
  • If you are coming here because all of your attempts to change your password are inexplicably being rejected, it could be that the "Minimum password age" has been set, typically to one day. If so then that means that if your admin has set some password for you, then you will have to wait a day before you can change it.
    – dangph
    Commented Jun 12, 2023 at 7:28

6 Answers 6


Every AD user can see the value of the attribute named "pwdProperties", your id probably set to "DOMAIN_PASSWORD_COMPLEX" (value "1", integer).

AdFind can be used to retrieve many attributes relative to passwords:

AdFind.exe -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength pwdproperties

Here is an example of what you'll get:

AdFind V01.45.00cpp Joe Richards ([email protected]) March 2011

Using server: domain.example.org:389 Directory: Windows Server 2008 R2 Base DN: DC=domain,DC=example,DC=org


lockoutDuration: -18000000000
lockOutObservationWindow: -18000000000
lockoutThreshold: 0
maxPwdAge: -344736000000000
minPwdAge: 0
minPwdLength: 7
pwdProperties: 1
pwdHistoryLength: 2

1 Objects returned


This Windows built-in command (use the Command Prompt : cmd.exe) prints the same details as the tool in answer:

net accounts

Example output:

C:\>net accounts
Force user logoff how long after time expires?:       Never
Minimum password age (days):                          0
Maximum password age (days):                          42
Minimum password length:                              0
Length of password history maintained:                None
Lockout threshold:                                    Never
Lockout duration (minutes):                           30
Lockout observation window (minutes):                 30
Computer role:                                        WORKSTATION
The command completed successfully.

Credits/source: http://windowsitpro.com/security/discovering-details-about-domains-password-policy

  • 2
    You the real MVP. technet.microsoft.com/en-us/library/bb490698.aspx
    – HackSlash
    Commented Jan 25, 2018 at 22:58
  • 7
    You should add that "/domain" is required in an AD controlled environment: "net accounts /domain"
    – HackSlash
    Commented Jan 25, 2018 at 23:00
  • @HackSlash What do you mean? My workstation is a member of a domain and the plain net accounts command prints all of the above information without problems. Commented Apr 12, 2019 at 14:19
  • When you use the /domain you see this message: The request will be processed at a domain controller for domain
    – HackSlash
    Commented Apr 15, 2019 at 15:22
  • 4
    Notce that the results don't include password complexity. These are the same results that NetUserModalsGet function returns - and which also is missing "password complexity" - the entire point of the question.
    – Ian Boyd
    Commented Apr 16, 2020 at 21:19

Right Click "Password must meet complexity requirements", then select "Explain" tab.

enter image description here


Since it is AD, currently there is only a single complexity (per se) pattern available: the so-called 3 of 4 pattern. It is either on or off, unless you use a third party tool like Spec Ops to enforce some other level of complexity. Three of Four means your password needs to include at least one character from three of the 4 possible character sets:

  2. lower case
  3. Numeric (0-9)
  4. Comic book curse words (aka special characters: !@#$%^&*(*))_+ etc)
  • 1
    What version of windows are you talking about? There are six configurable parameters in the default Password Policy provided by AD.
    – HackSlash
    Commented Jan 25, 2018 at 22:57
  • Space is also considered a special character.
    – brianary
    Commented May 21, 2018 at 21:03
  • This is insanely useful: I was only able to set a passsword that had four of the four.
    – chx
    Commented Sep 9, 2021 at 5:41

Run in PowerShell:

Get-ADDefaultDomainPasswordPolicy -Current LoggedOnUser


ComplexityEnabled           : True
DistinguishedName           : DC=ad,DC=company,DC=net
LockoutDuration             : 00:30:00
LockoutObservationWindow    : 00:30:00
LockoutThreshold            : 12
MaxPasswordAge              : 180.00:00:00
MinPasswordAge              : 1.00:00:00
MinPasswordLength           : 8
objectClass                 : {domainDNS}
objectGuid                  : 641734ff-9d4c-40b4-a28a-b9628c021639
PasswordHistoryCount        : 24
ReversibleEncryptionEnabled : False
  • This is especially good for finding the user policy when the user accounts and computer accounts are in different domains. Commented Mar 5, 2021 at 16:53
  • This is a great command but I find that it is not available on most machines I use and is quite hard to install on non server OS.
    – Fredrik C
    Commented Apr 8 at 14:43

I don't believe, short of brute force attempts, that there's any way programmatically to do this unless you're already an admin. So, you'll have to call IT. (The defaults vary depending on what they've got set up, although if you know that I guess you could look up the defaults and try. No guarantee that they haven't changed it, of course.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .