How to fix Error 1366 on Windows 11

by

Why This Error Happens

Error 1366 (“The logon session ID is already in use”) typically occurs when the Local Security Authority Subsystem Service (LSASS) encounters a session identifier collision, often due to corrupted authentication tokens or a stale session cache. This can happen after abrupt shutdowns, forced logoffs, or when third-party security software interferes with session management. Corrupted Group Policy caches or damaged Security Account Manager (SAM) database entries can also trigger this conflict.

Step-by-Step Resolution Guide

Step 1: Restart the Netlogon and LSASS-Dependent Services

  • Open Services (services.msc) via Win + R.
  • Locate Netlogon, right-click, and select Restart.
  • If greyed out, restart via elevated Command Prompt: net stop netlogon && net start netlogon.

Step 2: Clear Cached Logon Sessions

  • Open Command Prompt as Administrator.
  • Run klist sessions to view active session IDs.
  • Purge stale Kerberos tickets with klist purge.
  • Sign out completely and sign back in to force a new session ID allocation.

Step 3: Run System File and DISM Repair

  • Open an elevated Command Prompt.
  • Run sfc /scannow to repair corrupted system files tied to session management.
  • Follow with DISM /Online /Cleanup-Image /RestoreHealth to fix underlying Windows image corruption.
  • Restart the machine after completion.

Step 4: Check for Group Policy or Security Software Conflicts

  • Navigate to Local Group Policy Editor (gpedit.msc) > Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
  • Review policies related to “Network security” and “Interactive logon” for misconfigurations.
  • Temporarily disable third-party antivirus/endpoint protection to rule out session-hooking conflicts, then retest.

Step 5: Reset the Security Account Manager (SAM) Cache

  • Boot into Safe Mode.
  • Navigate to C:\Windows\System32\config and verify the SAM, SECURITY, and SYSTEM hive files are not corrupted (compare timestamps/sizes with a backup or system restore point).
  • Restore from a known-good backup if corruption is confirmed, then reboot normally.

Alternative or Verification Steps

  • Verify the fix by opening Event Viewer (eventvwr.msc) under Windows Logs > System and confirming Error 1366 no longer appears after a fresh logon cycle.
  • If the issue persists, create a new local user profile via Settings > Accounts > Other Users to confirm whether the original profile’s session cache was the root cause.