Fix ERROR_PASSWORD_MUST_CHANGE (0X00000773) on Windows

What's actually happening with 0X00000773

You try to log in, and Windows throws this at you: The user's password must be changed before logging on the first time. Error code 0X00000773. Annoying, but it's not corruption or a broken install. Windows is enforcing a policy. Either the account was created with "User must change password at next logon" ticked, or a domain policy expired the password. The reason you get this instead of a normal login screen is that Windows won't even let you reach the desktop until the password changes. And sometimes the change password dialog itself fails—that's when you need the workarounds below.

30-second fix: Use the change password prompt (if it appears)

In many cases, you'll see a login screen with a message like "Your password has expired and must be changed." If so, you're in luck. Here's what to do:

1. Type your current password in the password field.
2. Click OK or press Enter.
3. You'll get a dialog asking for a new password and confirmation. Enter it twice.
4. Click the arrow or press Enter to submit.

That's it. If that dialog works, you're done. But if it fails with 0X00000773, or if you never see the prompt, move to the next section.

5-minute fix: Force a password change from another admin account

If the change password dialog doesn't appear or keeps erroring, log in with a different admin account on the same machine. That could be a local admin or another domain admin. Then run a command to reset the password.

Open Command Prompt as administrator and run:

net user <username> <newpassword> /domain

Replace <username> with the affected account and <newpassword> with a temporary password. If it's a local account, drop the /domain switch:

net user <username> <newpassword>

After that, log in with the new password. Windows might still ask you to change it again at next logon (because the policy flag is still set). If so, you can clear that flag by running:

net user <username> /logonpasswordchg:no

For domain accounts, use:

net user <username> /logonpasswordchg:no /domain

That tells Windows not to force a change next time. Then log in normally.

If you don't have another admin account, you're stuck. You'll need to boot into Safe Mode or use a password reset disk. That's the 15-minute route.

15+ minute fix: Offline password reset or Safe Mode

No admin access? Then you need to get creative. The goal is to either enable the built-in Administrator account or reset the password without logging in.

Option A: Safe Mode with Command Prompt

1. Restart your PC. As soon as Windows starts loading, hold the power button to force a shutdown. Do this twice. On the third boot, Windows should enter Automatic Repair.
2. Go to Troubleshoot > Advanced options > Startup Settings > Restart.
3. After restart, press 6 or F6 to enable Safe Mode with Command Prompt.
4. At the command prompt, run:

   net user <username> <newpassword>

5. Then clear the forced change flag:

   net user <username> /logonpasswordchg:no

6. Restart normally and log in with the new password.

This works because Safe Mode bypasses some policy enforcement. But it won't help if the account is a domain account and you're offline—the domain controller isn't reachable.

Option B: Use a Linux live USB to reset the password

If Safe Mode doesn't work or you don't have admin rights, you can use a Linux live USB (like Ubuntu) to replace the Utilman.exe or sethc.exe with cmd.exe, then trigger the command prompt at the login screen. This is more involved and requires physical access. We won't cover the full steps here, but it's a well-known technique. The gist: boot from the USB, mount the Windows partition, copy cmd.exe over Utilman.exe, reboot, then at the login screen press Win+U to get a command prompt with SYSTEM privileges. From there, you can reset passwords and clear flags.

Need a full walkthrough? Search for "Utilman.exe password reset"—there are plenty of guides. Just be aware that this modifies system files, so back up if you can.

Why this happens: the policy behind 0X00000773

Windows stores a flag in the SAM database or Active Directory called PasswordMustChange. When set, the OS refuses to issue a logon token until the password is updated. This is separate from "password expired"—that's a different error. The trigger is usually an admin creating an account with "User must change password at next logon" checked, or a Group Policy that enforces it for new users. On domain-joined machines, the default domain policy might set it for all accounts.

The error code 0X00000773 is STATUS_PASSWORD_MUST_CHANGE. It's a hard block. No amount of registry tweaking will bypass it without clearing that flag.

What if the change password dialog fails?

Sometimes you get the prompt, enter a new password, and it still fails with 0X00000773. That usually means the new password doesn't meet complexity requirements, or there's a mismatch between local and domain policies. Check the password policy: minimum length, complexity (uppercase, lowercase, number, symbol), and history (can't reuse last N passwords). If you're on a domain, the domain controller enforces it. You can't override it locally. Just pick a password that satisfies the strictest policy.

Another cause: the secure channel between the machine and the domain is broken. Run nltest /sc_verify:<domain> to check. If it fails, you'll need to rejoin the domain or reset the machine account password. That's a bigger job—call your IT admin.

Preventing this in the future

If you manage accounts, don't tick "User must change password at next logon" unless you really need to. It's a common source of helpdesk tickets. Instead, set a temporary password and tell the user to change it manually. For domain environments, consider fine-grained password policies to avoid blanket enforcement.

For end users: change your password before it expires. Windows usually warns you at login, but if you ignore it, you'll hit 0X00000773. Set a calendar reminder. It takes 30 seconds to avoid the headache.