Skip to main content
Jackie_T
Staff & Editor
Jackie_T
Staff & Editor
October 6, 2025

Troubleshooting Tip: Cannot change the password for Windows Local User

  • October 6, 2025
  • 0 replies
  • 754 views
Description This article describes the issue of being unable to change the password for a Windows local user. The error message 'Password change failed (SAMR connection to machine failed. Error was NT_STATUS_ACCESS_DENIED, but LANMAN password changes are disabled)' is encountered.
Scope FortiPAM.
Solution

To resolve this issue, it is necessary to understand that Microsoft Windows 2025 has updated its security policy and no longer allows password changes using the Samba method. The current workaround is to use LDAPs for password changes.

 

Here are the steps to follow:

  1. Ensure that the Windows machine is configured to allow LDAP connections.
  2. Configure FortiPAM to use LDAP for password changes.
  3. Test the password change functionality to ensure it is working as expected.

 

To get more detailed information, run the debug commands on FortiPAM CLI :

 

diagnose wad debug enable category secret
diagnose wad debug enable category ldap
diagnose wad debug enable category pwdchg
diagnose wad debug enable category auth
diagnose wad debug enable level verbose
diagnose debug enable

 

Additionally, it is recommended to review the Microsoft documentation on the updated security policy for Windows 2025, which can be found at What's new in Windows Server 2025.

Terms & ConditionsAccessibility statement
Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!