How to fix Error 1349 on Windows 11

by

Troubleshooting Guide: Error 1349 – “The Type of the Token Is Inappropriate for Its Attempted Use”

Why This Error Happens

Error 1349 typically occurs when a security token being used for authentication does not match the type expected by the requesting process, often due to a mismatch between an impersonation token and a primary token. This is common when a service, scheduled task, or application attempts to use a token from a different logon session or context than the one it was designed to handle. Corrupted user profiles, incorrect credential caching, or misconfigured Local Security Authority (LSA) settings can also trigger this token validation failure.

Step-by-Step Resolution Guide

Step 1: Verify Account Permissions and Logon Type

  • Open Local Security Policy (secpol.msc) and navigate to Local Policies > User Rights Assignment.
  • Confirm the affected account has both “Log on as a service” and “Impersonate a client after authentication” rights if it runs a service or scheduled task.
  • Check Task Scheduler (taskschd.msc) and ensure the task is configured to “Run whether user is logged on or not” rather than “Run only when user is logged on.”

Step 2: Clear Cached Credentials and Tokens

  • Open Credential Manager via Control Panel > User Accounts > Credential Manager.
  • Remove any outdated or duplicate entries under “Windows Credentials” related to the affected application or network resource.
  • Run klist purge in an elevated Command Prompt to clear cached Kerberos tickets that may be holding an invalid token type.

Step 3: Rebuild the User Profile

  • Navigate to C:\Users\<Username> and rename the folder to <Username>.old after logging out of all sessions.
  • Restart the PC and log back in to force Windows 11 to generate a fresh profile with new token references.
  • Reinstall or restart the application that triggered Error 1349 to confirm it now generates a valid primary token.

Step 4: Check Group Policy and Registry Token Settings

  • Open gpedit.msc and go to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
  • Ensure “Network access: Let Everyone permissions apply to anonymous users” is set correctly based on your environment’s security baseline.
  • Verify the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa does not have conflicting DisableRestrictedAdmin or TokenLeakDetectDelaySecs values that were manually altered.

Alternative or Verification Steps

  • To verify the fix, re-run the specific application or service that threw Error 1349 and check the Event Viewer (eventvwr.msc) under Windows Logs > System to confirm the error no longer appears.
  • If the issue persists, run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth in an elevated Command Prompt to rule out underlying system file corruption affecting the token authentication chain.