How to fix Error 1387 on Windows 11

by

Why This Error Happens

Error 1387 occurs when Windows attempts to resolve a Security Identifier (SID) for a user or group account that no longer exists or cannot be found in the local Security Accounts Manager (SAM) database or Active Directory. This typically happens when an account was deleted, the machine lost trust with a domain, or the local group membership database contains a “orphaned” or corrupted SID reference. It can also occur if the account name was mistyped or if there is a connectivity issue preventing the domain controller from validating the account.

Step-by-Step Resolution Guide

Step 1: Verify the Account Exists and Is Spelled Correctly

  • Open Computer Management (right-click Start > Computer Management).
  • Navigate to System Tools > Local Users and Groups > Users.
  • Confirm the exact username or group name you are trying to add/remove exists and matches spelling exactly (including domain prefix, e.g., DOMAIN\Username).
  • If using PowerShell, run: Get-LocalUser or Get-ADUser -Identity "username" to confirm existence.

Step 2: Check Domain Connectivity and Trust Relationship

  • If the account is a domain account, ensure the PC has a stable network connection to the Domain Controller.
  • Run nltest /sc_query:yourdomain.com in an elevated Command Prompt to verify the secure channel trust status.
  • If the trust is broken, reset it using: Reset-ComputerMachinePassword -Server "DC01" -Credential (Get-Credential).
  • Restart the machine after resetting the trust relationship.

Step 3: Remove Orphaned SIDs from the Local Group

  • Open Local Users and Groups, right-click the affected group (e.g., “Administrators”) and select Properties.
  • Look for members displaying as raw SIDs (e.g., S-1-5-21-...) instead of readable names—these are orphaned entries.
  • Select the orphaned SID entry and click Remove to clear the broken reference.
  • Alternatively, use PowerShell: Remove-LocalGroupMember -Group "Administrators" -Member "S-1-5-21-xxxxxxxxxx".

Step 4: Re-Add the Member Using a Fresh Reference

  • Once orphaned entries are cleared, attempt to add the member again via Add in Group Properties, or run: Add-LocalGroupMember -Group "Administrators" -Member "DOMAIN\Username".
  • Ensure you are using the Object Types button in the “Select Users” dialog to properly search and validate the account before confirming.

Alternative or Verification Steps

  • To verify the fix, reopen Computer Management > Local Users and Groups, check the target group’s membership list, and confirm the account now displays with a readable name (not a raw SID).
  • If the issue persists, use dsa.msc (Active Directory Users and Computers) on a domain-joined environment to confirm the account isn’t disabled, expired, or located in a different OU than expected.