How to fix Error 399 on Windows 11

by

Why This Error Happens

Error 399 occurs because the SYSKEY utility (syskey.exe) has been deprecated and removed from Windows starting with certain Windows 10/11 builds due to security vulnerabilities associated with third-party syskey encryption. Your system’s registry still contains a legacy configuration flag indicating that an externally stored (Option 3 / floppy disk or USB-based) syskey was previously enabled, but the underlying feature no longer exists in the OS to process it. This mismatch between the stored security policy and the missing feature triggers the error on boot or during security audits.

Step-by-Step Resolution Guide

  1. Confirm the SYSKEY status via Registry:
    Press Win + R, type regedit, and navigate to:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Look for the value SecureBoot. If it’s set to 2, an external key was configured.

  1. Remove the legacy SYSKEY dependency (if system boots normally):
    Since syskey.exe is removed, you cannot revert this via GUI. Instead, back up the registry key above, then reset the SecureBoot DWORD value to 0 (this restores default password-based encryption behavior, not to be confused with UEFI Secure Boot).

⚠️ Warning: Only do this if you have a full system backup. Incorrect changes to LSA keys can render the system unbootable.

  1. If the system fails to boot due to missing syskey media:
    Boot into Windows Recovery Environment (WinRE) using installation media, open Command Prompt, and run:
   reg load HKLM\TempSystem C:\Windows\System32\config\SYSTEM
   reg delete "HKLM\TempSystem\ControlSet001\Control\Lsa" /v SecureBoot /f
   reg unload HKLM\TempSystem

Reboot normally afterward.

  1. Update Group Policy / Security Baseline:
    Ensure your organization’s security templates or GPOs no longer reference the deprecated syskey.exe feature, as importing an outdated security baseline can re-trigger Error 399 after remediation.

  2. Apply the latest Cumulative Update:
    Go to Settings > Windows Update and ensure all patches are installed, as Microsoft’s KB article (linked in the error) confirms this is an expected deprecation notice, not a bug — later builds suppress the warning once the flag is cleared.

Alternative or Verification Steps

  • Verify the fix: Restart the machine and check Event Viewer (eventvwr.msc) under Windows Logs > System to confirm Error 399 no longer appears on subsequent boots.
  • Alternative: If registry editing is restricted by policy, use an elevated PowerShell session with Set-ItemProperty to modify the SecureBoot value remotely via a script, especially useful for fleet-wide deployment.