I have a DNN site running DNN 7.04.00 (353). I am not able to reset passwords on my site. If I utilize the built-in password reset functionality I can receive the password reset email with a link. I click the link, enter my email address and new password. No matter what I do I keep getting an error that states, "Your new password was not accepted for security reasons. Please make sure to choose a password which does not match a previously used password and which is long and complex enough to meet the sites password complexity requirements."

Here's what's weird about it, I am entering a strong password that has never been used before. When I do this, I can see the following things happen:

• Password reset link is sent with password token. I can see this same token in the "Users" table.
• I follow the link. Attempt to reset the password using a valid and not previously used password. No matter what, I receive the error above.
• The Users.PasswordResetToken column value is reset. The Users.PasswordRestExpiration is set to null. This tells me that I've used the token and it is no longer valid.
• Here's what's really strange... the aspnet_Membership.Password hash value is never changed... okay that makes since, I couldn't successfully change the password. However, I now have a new entry in the PasswordHistory table. The value here is hashed, however it looks like the reset password I entered was stored in the PasswordHistory table... the new password did not get stored in the aspnet_Membership table like I would expect.

No matter what my password isn't accepted, however it's stored in the PasswordHistory table. Does anyone have any idea what could cause this? A few notes that may help:

• Users register for accounts on my site via a custom registration module, not the default DNN registration module.
• In the DNN web.config I have the following settings
  • passwordStrengthRegularExpression is non-existent, I have removed this completely from web.config for troubleshooting.
  • enablePasswordReset is true
  • requireQuestionAndAnswer is true
  • passwordFormat is hashed
  • minRequiredPasswordLength is 8
  • minRequiredNonalphanumericCharacters is 1

​I'm using a brand new password which meets these requirements, for example "ChickEnHea%d", however no matter what I try the password is not accepted.

Thank you for your help.