How to fix Error 686 on Windows 11

by

Windows Error 686 Troubleshooting Guide

Why This Error Happens

Error 686 (ERROR_INSECURE_SOURCE_MODULE_LOADED or a similar internal identifier) occurs when the Windows loader detects that an application is attempting to dynamically load a legacy or unsigned DLL/module that has a known, more secure replacement registered on the system. This typically happens with older applications that hardcode calls to specific system libraries (like older CRT or COM DLLs) instead of allowing Windows 11 to redirect them to their secure counterparts. It is essentially a security binding policy conflict rather than a corruption issue, though corrupted manifest files can also trigger it.

Step-by-Step Resolution Guide

  1. Identify the Requesting Application
    Open Event Viewer (Win + R > eventvwr.msc), navigate to Windows Logs > Application, and locate the Error 686 event. Note the exact module names (%hs) listed in the “insecure” and “secure” slots of the message.

  2. Check for Application Updates
    Since this error usually stems from outdated application binaries, check the vendor’s website or use winget upgrade --all in an elevated PowerShell terminal to see if a patched version resolves the hardcoded module call.

  3. Modify the Application Manifest (If Custom/Legacy App)
    If you have access to the application’s manifest file (usually AppName.exe.manifest located in the app’s install directory), ensure it does not explicitly bind to the outdated DLL version. Remove any <bindingRedirect> entries pointing to the insecure module, allowing Windows to use its default secure module resolution.

  4. Use the SXS (Side-by-Side) Assembly Cache
    Corruption in the Side-by-Side assembly store can cause the OS to fail to find the “secure” alternative, forcing a fallback warning. Run the System File Checker to repair this:

   sfc /scannow

Follow this with a DISM health restore:

   DISM /Online /Cleanup-Image /RestoreHealth
  1. Run the Application in Compatibility Mode
    Right-click the application’s .exe file > Properties > Compatibility tab > Check Run this program in compatibility mode for: and select an earlier version of Windows. This forces the OS to load the legacy module set without triggering the secure module comparison check.

Alternative or Verification Steps

  • Verify the Fix: Reopen Event Viewer after performing the steps above and attempt to reproduce the error by relaunching the application. If Error 686 no longer appears in the Application log, the secure module redirection is working correctly.
  • Alternative Solution: If the error persists and the application is non-essential legacy software, consider running it inside a sandboxed environment (Windows Sandbox or a Hyper-V VM) to isolate the insecure module call from your primary OS environment entirely.