How to fix Error 1301 on Windows 11

by

Troubleshooting Guide: Windows Error 1301 – Account Name to SID Mapping Failure

Why This Error Happens

Error 1301 occurs when Windows attempts to apply security permissions during a policy update, software installation, or profile load, but fails to translate one or more account names into their corresponding Security Identifiers (SIDs). This typically happens when a user or group account referenced in a security template, Group Policy Object (GPO), or ACL no longer exists (a stale or orphaned SID), the account is misspelled, or the local Security Accounts Manager (SAM) database is corrupted or out of sync with Active Directory. It can also occur if the machine is disconnected from the domain controller and cannot resolve domain-based accounts.

Step-by-Step Resolution Guide

Step 1: Identify the Problematic Account or SID

  • Open Event Viewer (eventvwr.msc) and navigate to Windows Logs > Application or System.
  • Locate the Event ID 1301 entry and expand details to note the exact account name or SID string that failed to resolve (e.g., S-1-5-21-...).
  • Cross-reference this SID using PowerShell: Get-ADObject -Filter {ObjectSID -eq "S-1-5-21-XXXX"} to check if the account still exists in Active Directory.

Step 2: Review and Repair the Security Policy Database

  • Open Local Security Policy (secpol.msc) and check Local Policies > User Rights Assignment for any orphaned SIDs listed instead of readable account names.
  • Remove any broken/orphaned SID entries manually from the affected policy.
  • Alternatively, reset the local security database by running: secedit /configure /db %windir%\security\database\secedit.sdb /cfg %windir%\inf\defltbase.inf /overwrite /log secedit_reset.log

Step 3: Force a Group Policy Refresh

  • Run gpupdate /force in an elevated Command Prompt to reapply policies and re-attempt SID resolution.
  • If the machine is domain-joined, verify connectivity to the domain controller using nltest /sc_query:YourDomainName to rule out network-based resolution failures.

Step 4: Rebuild or Restore the SAM Database (If Local Corruption is Suspected)

  • Boot into Safe Mode and check the integrity of the registry hive at C:\Windows\System32\config\SAM.
  • If corruption is confirmed, restore a clean backup of the SAM hive from a System Restore Point or a verified backup taken before the issue began.
  • Reboot normally and re-check Event Viewer for recurrence of Error 1301.

Alternative or Verification Steps

  • After applying fixes, re-run gpresult /h report.html and inspect the HTML report to confirm all security policies apply without errors and no unresolved SIDs remain.
  • If the error persists, consider using the Sysinternals PsGetSid tool to manually validate specific accounts, or perform a clean re-join of the machine to the domain to refresh all account-to-SID mappings.