How to fix Error 1352 on Windows 11

by

Windows 11 Troubleshooting Guide: Error 1352 (SAM/LSA Wrong State)

Why This Error Happens

Error 1352 typically occurs when the Security Account Manager (SAM) or Local Security Authority (LSA) database becomes desynchronized, often due to a domain trust relationship failure or a corrupted secure channel between the workstation and the domain controller. This can also arise from inconsistent replication data between Active Directory domain controllers, or from a local SAM database that has been corrupted due to an improper shutdown or disk error. In some cases, the LSA process is temporarily locked because a previous security operation—such as a password reset or trust reset—did not complete cleanly.

Step-by-Step Resolution Guide

Step 1: Verify the Domain Trust Relationship

  • Open PowerShell as Administrator and run Test-ComputerSecureChannel -Verbose to check if the secure channel to the domain is broken.
  • If the command returns False, run Test-ComputerSecureChannel -Repair -Credential (Get-Credential) and enter domain admin credentials to reset the trust relationship.
  • Restart the machine after the repair completes to apply the reset channel.

Step 2: Restart the Netlogon and LSA-Dependent Services

  • Open the Services console (services.msc).
  • Locate Netlogon, right-click, and select Restart. If it fails to restart, stop it manually first, then start it again.
  • Alternatively, run the following in an elevated Command Prompt: net stop netlogon && net start netlogon.
  • Check the System event log for Event ID 5719 or 3210, which often accompanies Error 1352 and confirms a Netlogon-related root cause.

Step 3: Check and Repair the Local SAM Database

  • Run sfc /scannow in an elevated Command Prompt to detect and repair corrupted system files, including registry hives tied to the SAM database.
  • Follow this with DISM /Online /Cleanup-Image /RestoreHealth to repair the underlying Windows image if SFC reports unfixable errors.
  • Reboot the system once both scans complete successfully.

Step 4: Reset the Machine Account Password

  • If the trust relationship issue persists, unjoin the computer from the domain via Settings > Accounts > Access work or school.
  • Restart the PC, rejoin the domain using valid credentials, and confirm the machine account password resets in Active Directory Users and Computers (ADUC).
  • This regenerates a clean secure channel key, eliminating stale SAM/LSA state conflicts.

Step 5: Check Group Policy and Time Synchronization

  • Ensure the workstation’s clock is within 5 minutes of the domain controller’s time, as Kerberos authentication failures can trigger Error 1352 indirectly.
  • Run w32tm /resync to force a manual time sync.
  • Run gpupdate /force to ensure no stale Group Policy security settings are causing the LSA state conflict.

Alternative or Verification Steps

  • Verify the fix: Reopen the application or management console (e.g., Local Users and Groups, ADUC) that originally triggered Error 1352, and attempt the security operation again (such as changing a password or modifying a security group).
  • Alternative solution: If the error persists only on one specific domain controller, use repadmin /replsummary on that DC to check for Active Directory replication failures, as inconsistent SAM data across DCs can independently trigger this error on client machines.