How to fix Error 1311 on Windows 11

by

Why This Error Happens

Error 1311 occurs when Windows 11 cannot establish a secure connection to your organization’s domain controller to validate your credentials, typically because the device lost network connectivity to the domain, DNS resolution is failing, or the machine’s cached domain trust relationship has become corrupted. This is common on laptops that sleep/hibernate while disconnected from VPN or corporate Wi-Fi, causing the cached Kerberos ticket to expire before a new one can be issued. Additionally, a mismatched system clock (outside the 5-minute Kerberos tolerance) or a broken secure channel between the workstation and Active Directory can trigger this same error.

Step-by-Step Resolution Guide

Step 1: Verify Network and VPN Connectivity

  • Confirm the device is physically connected to Ethernet or the correct corporate Wi-Fi SSID.
  • If working remotely, launch your VPN client (Cisco AnyConnect, GlobalProtect, etc.) and ensure the tunnel status shows “Connected” before attempting sign-in.
  • Test connectivity by opening Command Prompt and running: ping yourdomain.com

Step 2: Sync the System Clock

  • Open Settings > Time & Language > Date & Time.
  • Toggle “Set time automatically” to Off, then back On to force a resync.
  • Alternatively, run this in an elevated Command Prompt: w32tm /resync /force
  • Verify the time matches your domain controller within a 5-minute window (Kerberos requirement).

Step 3: Flush DNS and Reset the Secure Channel

  • Open Command Prompt as Administrator.
  • Run: ipconfig /flushdns
  • Run: ipconfig /registerdns
  • Restart the Netlogon service by running: net stop netlogon followed by net start netlogon

Step 4: Repair the Domain Trust Relationship

  • If the above steps fail, sign in with a local administrator account or a previously cached credential.
  • Open PowerShell as Administrator and run: Test-ComputerSecureChannel -Repair -Credential (Get-Credential)
  • Enter domain admin credentials when prompted to re-establish the trust.

Step 5: Restart the Device and Attempt Sign-In Again

  • Perform a full restart (not sleep/hibernate) to clear cached authentication states.
  • Ensure network/VPN is active before the sign-in screen loads, as domain validation happens at that stage.

Alternative or Verification Steps

  • Verify the fix: Sign out completely and sign back in with your domain credential while connected to the network; a successful desktop load with no error confirms resolution.
  • Alternative solution: If the issue persists, unjoin the device from the domain via Settings > Accounts > Access work or school, restart, then rejoin the domain using valid credentials while connected to the corporate network.