How to fix Error 1330 on Windows 11

by

Windows 11 Error 1330: “The Password for This Account Has Expired”

Why This Error Happens

Error 1330 occurs when Windows attempts to authenticate an account—often a service account, scheduled task credential, or domain-joined user—whose password has passed its maximum password age policy without being updated. This is commonly triggered by Group Policy password expiration settings, a stored credential in Windows Credential Manager that is out of sync with the actual account password, or a service running under a local/domain account that never had its password renewed after an admin-forced reset. The underlying authentication token (Kerberos or NTLM) is rejected by the Local Security Authority (LSA) because the account’s pwdLastSet attribute exceeds the domain or local policy threshold.

Step-by-Step Resolution Guide

Step 1: Reset the Account Password Directly

  • Press Ctrl + Alt + Del on the affected machine and select “Change a password” if it’s a local user.
  • For domain accounts, log in from another working session or ask an admin to reset it via Active Directory Users and Computers (ADUC) > right-click user > Reset Password.
  • Ensure the “User must change password at next logon” box is unchecked if this is a service account.

Step 2: Update Stored Credentials in Credential Manager

  • Open Control Panel > User Accounts > Credential Manager.
  • Locate the entry under “Windows Credentials” tied to the expired account (often listed under enterprise or generic credentials).
  • Click Edit or Remove, then re-enter the new password so Windows re-caches the correct token.

Step 3: Adjust Password Expiration Policy (For Service/System Accounts)

  • Open secpol.msc (Local Security Policy) or Group Policy Management for domain environments.
  • Navigate to Account Policies > Password Policy > Maximum password age.
  • For dedicated service accounts, consider setting the password to “Never Expire” via ADUC (checkbox under Account tab) if company policy allows.

Step 4: Restart Dependent Services

  • Open services.msc, locate the service tied to the account (e.g., SQL Server, IIS App Pool, or a custom scheduled task).
  • Right-click > Properties > Log On tab, re-enter the new password, click Apply.
  • Restart the service to force it to re-authenticate with the updated credential.

Alternative or Verification Steps

  • Run net user <username> in an elevated Command Prompt to check the Password expires and Password last set fields and confirm they now reflect a future expiration date.
  • If the error persists after a password reset, check for cached credentials on other devices (like RDP saved sessions) or verify time sync between the client and domain controller using w32tm /query /status, since Kerberos authentication failures can sometimes mimic password expiration errors.