Question: I'm seeing a strange problem with the ADFS updatepassword page. We're batch-creating users, and they are trying to change their passwords. However, roughly 50% of the accounts can't change their password, the following event is logged:

> 
> Password change failed for following user: 
> 
> 
> Additional Data 
> 
> 
> User: DOMAIN\username
> 
> 
> Device Certificate: 
> 
> 
> Server on which password change was attempted: ad01.ad.domain Error
>  details: NewPasswordHistConflict
> 
> 
> 

The error would indicate that the password is the same as the previous, but we've tested several different passwords, and still get the same error. I can't find anything special common between the accounts that have problems and those who don't. 

The users are created with this Powershell line:

```
New-ADUser -Name $displayName -DisplayName $displayName -SamAccountName $accountName`
           -GivenName $FirstName -Surname $LastName -EmailAddress $Email -Path $oupath`
           -UserPrincipalName "$accountName@ad.domain" -AccountPassword $securePassword `
           -Enabled $true

```

Any ideas? The domain controllers and ADFS is Windows 2012R2.

Answer: 
I've seen these types of problems (though not that specific one) because of the minimum password age policy. If set to 1 day it means that once the user changes their password, they cannot do so again for 1 day.

So when you bulk create you need a dummy password because you can't create a user without one and then the user changes the password on the same day etc.
I'm not terribly familiar with using ADFS to change passwords, but in my experience, AD doesn't get that specific with why a new password was rejected. It's usually just an error that the new password violated some aspect of the password policy (history, complexity, length, minimum age, etc).

In the interest of troubleshooting though, I'd probably try modifying your password policy temporarily. Start by setting the passwords remembered value to 0 so password history wouldn't be a problem anymore. If that doesn't solve it, keep loosening the policy one setting at a time until your failures go away and you'll hopefully arrive at the real problem.