I know this error is infuriating — you're just trying to set a password, and Windows hits you with 0X00000267. Let's fix it.
The error ERROR_PWD_TOO_SHORT (0X00000267) means the password you're entering doesn't meet the minimum length required by your user account's policy. The fix depends on whether you're on a local Windows machine or in an Active Directory domain.
Fix 1: Local Windows Account (Home or Standalone PC)
If your PC isn't joined to a domain, the policy is stored locally. Open an elevated Command Prompt (right-click Start → Terminal (Admin) or Command Prompt (Admin)) and run:
net accountsLook for Minimum password length. If it says something like 8, your new password needs at least 8 characters. To lower it, run:
net accounts /minpwlen:0That sets the minimum to 0 characters (effectively no minimum). If you'd rather keep a sane minimum, use /minpwlen:4 or whatever fits your security needs. After that, try setting the password again.
If net accounts doesn't stick (some systems override it via Group Policy), use the Local Security Policy editor:
- Press
Win + R, typesecpol.msc, hit Enter. - Go to Account Policies → Password Policy.
- Double-click Minimum password length.
- Set it to 0 (or a lower number), click OK.
Then run gpupdate /force in an elevated prompt to apply it immediately.
If secpol.msc is missing (Windows Home)
Home editions don't ship with secpol.msc. Use the registry instead. Open regedit and navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemLook for MinimumPasswordLength (DWORD). If it's there, set it to 0. If it's not there, you don't need to create it — the default is 0. Reboot and try again.
Fix 2: Active Directory Domain Account
On a domain, the policy comes from a Group Policy Object (GPO) linked to the domain or an OU. You can't fix this from the client. You need Domain Admin rights (or delegated rights) on a domain controller or a machine with RSAT installed.
- Open Group Policy Management (
gpmc.msc). - Find the GPO linked to your domain (usually Default Domain Policy) or the OU containing the user.
- Edit it: Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies → Password Policy.
- Double-click Minimum password length and set it to a lower value (or 0).
Run gpupdate /force on the domain controller. Clients will pick it up on their next refresh (usually within 90 minutes, or immediately if you force it).
If you're using Fine-Grained Password Policies (FGPP), check those too. They override the Default Domain Policy. Open Active Directory Administrative Center, go to your domain, then System → Password Settings Container. Look for any PSO that applies to the user or their groups.
Quick AD check from PowerShell
On a domain-joined machine with RSAT:
Get-ADDefaultDomainPasswordPolicyThat shows the effective minimum length. To see fine-grained policies:
Get-ADFineGrainedPasswordPolicy -Filter *Why This Fix Works
Windows enforces password length at two layers: the local SAM database (for local accounts) and Active Directory (for domain accounts). The error 0X00000267 is essentially the API saying "the password you gave me is shorter than the MinPasswordLength value I'm required to enforce."
When you change the policy, you're updating that MinPasswordLength value. The next time you set a password, the check uses the new value. On a domain, the client caches the policy from the last Group Policy refresh — that's why gpupdate /force matters. Skip it, and you'll keep hitting the error until the next automatic refresh, which can take up to 90 minutes.
One gotcha: if the account has Password must meet complexity requirements enabled, lowering the length alone might not be enough. Complexity requires at least 3 of these 4: uppercase, lowercase, digit, symbol. So a 4-character password like abcd still fails. Either add complexity or disable that setting too (not recommended for production).
Less Common Variations
1. You're changing password via net user and it fails
The net user command respects the same policy. If you run:
net user MyUser NewPass /domainand get 0X00000267, the policy is the issue — same fix as above. But note: on a domain, you need to target a DC. If you're on a member server, add /domain.
2. Password reset in ADUC fails with this error
Active Directory Users and Computers (ADUC) sometimes shows a generic "password does not meet policy" message, but the underlying code is 0X00000267. Check the Default Domain Policy and any PSOs linked to the user's OU. A PSO with a higher minimum length will override the default.
3. Azure AD / Microsoft 365
If you're syncing from on-prem AD, the cloud policy might also have a minimum length. In Microsoft 365 admin center, go to Settings → Org settings → Security & privacy → Password expiration policy. If you use Azure AD Connect with password hash sync, the on-prem policy wins for length. Fix it on-prem.
4. The error appears during OSD or imaging
Some deployment tools (MDT, SCCM) set a local admin password during imaging. If the task sequence uses a short password and the image has a stricter policy, you'll get 0X00000267. Edit the task sequence to use a longer password, or relax the policy in the image's unattend.xml.
Prevention
- Document your password policy — including minimum length — so users know what's expected. A one-page cheat sheet stops most support tickets.
- Use a password manager for local admin accounts. Generate 16+ character passwords and store them. You'll never hit the minimum again.
- Audit GPOs quarterly. Policies drift. Someone links a new GPO with a 14-character minimum and suddenly half your users can't change passwords.
- Test policy changes in a staging OU before rolling out domain-wide. A typo in
MinPasswordLengthcan lock out hundreds of accounts. - For domain accounts, check PSOs first when troubleshooting. They're easy to forget and they override everything else.
That's it. Nine times out of ten, lowering the minimum length (and forcing a policy refresh) clears 0X00000267 in under five minutes. The tenth time, it's a fine-grained password policy you forgot about.