How to fix Error 1389 on Windows 11

by

Windows 11 Error 1389: “Too Many Security IDs Have Been Specified” Troubleshooting Guide

Why This Error Happens

Error 1389 occurs when a Security Identifier (SID) list associated with a user account, group policy object, or access control list (ACL) exceeds the maximum number of entries the system can process in a single token or security descriptor. This is commonly triggered by corrupted user profiles, an excessively bloated Access Control List on a file, folder, or registry key, or a domain/local account that belongs to an unusually high number of security groups. In most cases, the root cause is a corrupted security descriptor that Windows cannot properly parse or enumerate.

Step-by-Step Resolution Guide

Step 1: Identify the Affected Object or Account

  • Note the exact file, folder, registry key, or user account that triggers the error when accessed.
  • Open Event Viewer (eventvwr.msc) and check the Windows Logs > System and Application logs for the exact timestamp and source of Error 1389.
  • Confirm whether the issue is tied to a specific local user profile or a shared network resource.

Step 2: Reset or Rebuild the Security Descriptor Using SubInACL or ICACLS

  • Open Command Prompt as Administrator.
  • Run the following command to reset permissions on the affected folder and rebuild inheritance:
    icacls "C:\Path\To\Affected\Folder" /reset /T /C
  • If the issue is on a system file or registry key, use secedit to reapply default security templates:
    secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose
  • Restart the machine and check if the error persists.

Step 3: Check and Trim Excessive Group Memberships

  • Open Computer Management (compmgmt.msc) and navigate to Local Users and Groups > Users.
  • Right-click the affected user account, select Properties, and review the Member Of tab.
  • If the account belongs to dozens of groups (common in domain environments), work with your Active Directory administrator to consolidate or remove redundant group memberships, since Kerberos tokens have a hard limit on the number of SIDs they can carry.

Step 4: Rebuild the Corrupted User Profile

  • Go to Settings > Accounts > Other Users (or System > About > Advanced system settings > User Profiles for the classic dialog).
  • Back up user data, then delete the corrupted profile and have Windows recreate it on next sign-in.
  • Alternatively, rename the old profile folder in C:\Users\ and create a new local profile to migrate data manually.

Step 5: Run System File Checker and DISM

  • Run sfc /scannow in an elevated Command Prompt to repair corrupted system files that may be mishandling the security descriptor.
  • Follow up with DISM /Online /Cleanup-Image /RestoreHealth to repair the underlying Windows image if SFC reports unfixable errors.

Alternative or Verification Steps

  • After applying fixes, try accessing the previously affected file, folder, or logging into the affected user account again to confirm Error 1389 no longer appears in Event Viewer.
  • If the error persists on a domain-joined machine, temporarily test with a local administrator account; if the error disappears, the issue is isolated to Active Directory group membership and should be escalated to your domain administrator for SID cleanup.