How to fix Error 1373 on Windows 11

by

Troubleshooting Guide: Error 1373 – “Cannot Perform This Operation on This Built-In Special User”

Why This Error Happens

Error 1373 occurs when an administrator attempts to modify, delete, rename, or reassign permissions for a built-in special user account (such as SYSTEM, Everyone, Authenticated Users, or similar protected security principals) in a way that Windows does not permit. These accounts are hardcoded into the Windows security model and are managed internally by the OS rather than through standard user administration tools. This typically happens when using Local Users and Groups, net user commands, or third-party permission tools to alter attributes reserved exclusively for the operating system’s SID-based accounts.

Step-by-Step Resolution Guide

Step 1: Identify the Specific Built-In Account Triggering the Error

  • Open Computer Management (compmgmt.msc) and navigate to Local Users and Groups > Users.
  • Check if the account you are trying to modify is a special identity (e.g., SYSTEM, LOCAL SERVICE, NETWORK SERVICE, Everyone, or Authenticated Users).
  • Confirm the exact action attempted (rename, delete, disable, or permission change) — these accounts do not support most administrative modifications.

Step 2: Use the Correct Tool for Permission Changes Instead of Account Modification

  • Instead of modifying the account directly, adjust permissions via File/Folder Properties > Security tab or icacls.
  • Open Command Prompt as Administrator and use:
  icacls "C:\path\to\folder" /grant "Authenticated Users":(OI)(CI)F
  • Avoid using net user [BuiltInAccount] /delete or similar commands on protected identities, as this always returns Error 1373.

Step 3: Reset Permissions Using Security Templates or Group Policy

  • Open Local Group Policy Editor (gpedit.msc) and navigate to Computer Configuration > Windows Settings > Security Settings.
  • Restore default security templates via secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose if permissions appear corrupted.
  • Reboot the system after applying the template to allow Windows to re-register default ACLs for built-in identities.

Step 4: Check for Third-Party Software Interference

  • Open Task Manager > Startup Apps and disable any third-party user-management or antivirus software temporarily.
  • Some endpoint security tools intercept SID-based account calls and incorrectly attempt to modify built-in users, triggering Error 1373.
  • Re-attempt the original administrative task after disabling these tools.

Alternative or Verification Steps

  • Verify the fix by re-running the original action (e.g., permission assignment) and confirming no Error 1373 dialog appears; check Event Viewer > Windows Logs > System for related entries.
  • If the issue persists, use whoami /user in an elevated Command Prompt to confirm your current session isn’t inadvertently mapped to a restricted built-in SID, and retry the operation using a standard domain/local admin account instead.