How to fix Error 1375 on Windows 11

by

Troubleshooting Guide: Error 1375 – “The Token Is Already in Use as a Primary Token”

Why This Error Happens

This error occurs when a process attempts to assign a security token to a user session, but that token has already been designated as the primary token for another active process or session. It commonly arises in Windows Authentication, Remote Desktop Services, or scripted logon operations (via LogonUser or CreateProcessAsUser API calls) where session handles aren’t properly released before a new logon attempt is made. Corrupted user profiles, stale RDP sessions, or third-party security software interfering with token management can also trigger this conflict.

Step-by-Step Resolution Guide

Step 1: Terminate Conflicting Sessions

  • Open Task Manager (Ctrl + Shift + Esc) and navigate to the Users tab.
  • Right-click any disconnected or duplicate user sessions and select Sign Out.
  • Alternatively, open Command Prompt as Administrator and run query session to list active sessions, then use logoff [session_ID] to force-close orphaned ones.

Step 2: Restart Core Authentication Services

  • Press Win + R, type services.msc, and press Enter.
  • Locate Remote Desktop Services and Security Accounts Manager (SAM).
  • Right-click each service, select Restart, and ensure the Startup Type is set to Automatic.

Step 3: Clear Cached Credentials and Tokens

  • Open Command Prompt as Administrator.
  • Run klist purge to clear cached Kerberos tickets that may be holding an invalid token reference.
  • Navigate to Control Panel > User Accounts > Credential Manager and remove any Windows Credentials tied to the failing application or remote host.

Step 4: Check for Profile Corruption

  • Go to Windows Settings > Accounts > Access work or school (or Local Users via netplwiz).
  • Verify the user profile isn’t loaded as a temporary profile (check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList in Registry Editor for a .bak folder conflict).
  • If a corrupted profile is confirmed, back up data and create a new local user profile to isolate the token issue.

Step 5: Reboot and Reapply Group Policy

  • Restart the Windows 11 machine to fully clear the Local Security Authority (LSA) cache.
  • Run gpupdate /force in Command Prompt post-reboot to ensure security policies re-sync correctly with the Domain Controller (if applicable).

Alternative or Verification Steps

  • Verification: After restarting the machine, attempt the original login or process execution again; check the Event Viewer (eventvwr.msc) under Windows Logs > System to confirm Error 1375 no longer appears.
  • Alternative Fix: If the error persists specifically during RDP sessions, disable Restricted Admin Mode by setting DisableRestrictedAdmin to 0 in the registry path HKLM\System\CurrentControlSet\Control\Lsa, as this feature sometimes conflicts with primary token assignment logic.