How to fix Error 1377 on Windows 11

by

Troubleshooting Guide: Error 1377 – “The Specified Account Name Is Not a Member of the Group”

Why This Error Happens

This error occurs when Windows attempts to remove or modify a user account’s membership in a local or domain group, but the account is not actually present in that group’s membership list. It commonly arises from stale Group Policy Objects (GPOs) that reference outdated Security Identifiers (SIDs), corrupted local security database entries, or scripts/tools attempting to remove a user from a group they were never added to. This is frequently seen during Restricted Groups policy processing or when using net localgroup commands with mismatched account data.

Step-by-Step Resolution Guide

Step 1: Verify Current Group Membership

  • Open Command Prompt as Administrator and run: net localgroup "GroupName" to list actual current members.
  • Compare this list against the account name causing the error to confirm the mismatch.
  • Check for trailing spaces, incorrect domain prefixes (e.g., DOMAIN\User vs User), or case sensitivity issues in the account name.

Step 2: Inspect and Correct Group Policy Restricted Groups Settings

  • Navigate to Local Group Policy Editor (gpedit.msc) or the relevant domain GPO in Group Policy Management Console.
  • Go to Computer Configuration > Windows Settings > Security Settings > Restricted Groups.
  • Locate the group referenced in the error and remove any invalid or duplicate account entries listed under “Members” or “Member Of.”
  • Run gpupdate /force in an elevated Command Prompt to reapply the corrected policy.

Step 3: Clear Stale SIDs from the Security Database

  • Open Registry Editor (regedit) and navigate to HKEY_LOCAL_MACHINE\SECURITY\SAM (requires taking ownership if access is denied).
  • Alternatively, use Get-LocalGroupMember -Group "GroupName" in PowerShell to identify orphaned SIDs that no longer resolve to a valid account.
  • Remove orphaned SIDs using Remove-LocalGroupMember -Group "GroupName" -Member "SID-or-AccountName".

Step 4: Rebuild the Group Membership Manually

  • Delete the problematic group reference using net localgroup "GroupName" /delete (only if the group is not a built-in default group).
  • Recreate the group and manually re-add valid accounts using net localgroup "GroupName" /add followed by net localgroup "GroupName" "UserName" /add.

Alternative or Verification Steps

  • Verify the fix by reopening Local Users and Groups (lusrmgr.msc), selecting the affected group, and confirming the member list matches expectations without triggering the error.
  • If the issue persists, run gpresult /h report.html to generate a Group Policy report and check for conflicting or duplicate policy definitions still pushing the invalid account.