How to fix Error 1382 on Windows 11

by

Windows 11 Troubleshooting Guide: Error 1382 – “The Length of a Secret Exceeds the Maximum Length Allowed”

Why This Error Happens

Error 1382 occurs when the Local Security Authority (LSA) attempts to store a secret—such as a cached credential, service account password, or trust relationship key—that exceeds the internal size limit imposed by the Windows Security Account Manager (SAM). This is often triggered by corrupted registry entries in the SECURITY hive, a malformed Group Policy password setting, or third-party credential management software writing oversized data into LSA storage. In some cases, domain trust password synchronization issues between a client and a Domain Controller can also generate this error.

Step-by-Step Resolution Guide

Step 1: Verify the Source of the Secret Data

  • Open Event Viewer (eventvwr.msc) and check the Windows Logs > System and Security logs for events immediately preceding Error 1382.
  • Identify whether the error correlates with a specific service, scheduled task, or Group Policy Object (GPO) applying credentials.
  • Note the account name or service tied to the failure, as this determines whether the issue is local or domain-related.

Step 2: Reset Cached LSA Secrets

  • Open Registry Editor (regedit) as Administrator.
  • Navigate to HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets.
  • Note: This key may appear empty due to permission restrictions; grant temporary Read access to your admin account via Permissions if needed to inspect the tree.
  • Back up the SECURITY hive using reg save HKLM\SECURITY C:\Backup\security.hiv in an elevated Command Prompt before making changes.
  • If a specific secret (e.g., a machine account password or service credential) appears corrupted, delete only that subkey and allow Windows to regenerate it on next reboot or service restart.

Step 3: Reset the Machine Account Password

  • Open Command Prompt as Administrator.
  • Run: netdom resetpwd /server:<DomainControllerName> /userd:<DomainAdminAccount> /passwordd:*
  • This resets the local computer’s secure channel password with the Domain Controller, which often resolves oversized or mismatched secret data.
  • Restart the machine after the command completes successfully.

Step 4: Check Group Policy and Password Length Settings

  • Open the Local Group Policy Editor (gpedit.msc).
  • Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
  • Confirm no custom scripts or third-party password vault tools are injecting passwords/secrets longer than 512 bytes (the LSA secret size limit).
  • Disable or uninstall any third-party credential managers temporarily to isolate the cause.

Step 5: Run System File and Component Store Repair

  • Open Command Prompt as Administrator.
  • Run: sfc /scannow
  • Follow with: DISM /Online /Cleanup-Image /RestoreHealth
  • This repairs corrupted system files that may be interfering with LSA’s secret storage mechanism.

Alternative or Verification Steps

  • After completing the steps above, re-run the operation that originally triggered Error 1382 (e.g., service login, scheduled task execution, or domain join) and confirm it completes without the error.
  • If the issue persists, consider rejoining the machine to the domain entirely (Remove from domain > Restart > Rejoin domain) to force a clean regeneration of all LSA secrets and trust relationships.