I'm running DNN Platform 9.9.1, maintain 30 different portals, and have ~4,000 users.  I often see users struggle with changing their password.  I've updated the error message (in the language resources) so that it identifies the custom password rules we have.  Regardless, some users still have problems and there's little useful information that DNN provides to the user to help them figure out the issue.  It could be a case of them trying a password that fails the rules, or they're using an invalid username, or they're using a password that has been previously used.  Whatever the issue, DNN provides the same basic error message.  This can get aggravating for users. 

Are there ways to alleviate some of these issues?  From a user's perspective, having better error messages would be useful (e.g. sorry that password violates doesn't conform to our password rules, sorry you've used that password recently please try another, sorry that username doesn't exist). 

I could see, though, that a security expert might balk at more in depth error messages because it might help a hacker in some fashion. 

Another approach would be to provide different errors in the EventLog table (within the DNN database).  This way an Admin can see what the issue is.  As it is right now, all of these forms of failed logins result in a FAILED LOGIN code.

Regards.