How to fix Error 320 on Windows 11

by

Troubleshooting Guide: Error 320 – Invalid Central Access Policy from Active Directory

Why This Error Happens

Error 320 occurs when the Central Access Policy (CAP) retrieved from Active Directory contains a reference to a Central Access Rule or claim type that no longer exists, has been corrupted, or was improperly replicated across domain controllers. This typically happens due to incomplete Group Policy replication, a mismatch between the CAP definition and its associated Central Access Rules in the Dynamic Access Control (DAC) configuration, or stale/cached policy data on the local machine. It can also occur if the CAP was deleted or modified in Active Directory Administrative Center (ADAC) without updating the linked Group Policy Object (GPO).

Step-by-Step Resolution Guide

  1. Verify the Central Access Policy in Active Directory:
    Open Active Directory Administrative Center (ADAC) → navigate to Dynamic Access Control > Central Access Policies. Confirm the policy referenced by the affected GPO still exists and is correctly linked to valid Central Access Rules.

  2. Check and Repair Central Access Rules:
    In the same DAC console, inspect Central Access Rules. Ensure each rule tied to the policy has valid Resource Conditions and Target Resources — a broken or missing claim type is a common cause of Error 320.

  3. Force Group Policy and AD Replication:
    On the affected Windows 11 machine, run:

   gpupdate /force

On the Domain Controller, force replication using:

   repadmin /syncall /A /e /P
  1. Clear Cached Policy Data Locally:
    Delete the cached CAP files from:
   C:\Windows\System32\GroupPolicy\DataStore\

Then restart the Group Policy Client service via services.msc or run gpupdate /force again to rebuild the cache.

  1. Recreate the Central Access Policy (if corruption persists):
    If the policy remains invalid, delete and recreate the CAP in ADAC, re-link it to the correct Central Access Rules, and reassign it via Group Policy under:
   Computer Configuration > Windows Settings > Security Settings > File System > Central Access Policy

Alternative or Verification Steps

  • Run gpresult /h report.html on the client machine and check the File System section to confirm the Central Access Policy now applies without errors.
  • If the issue persists, temporarily unlink the GPO containing the CAP, allow policy to refresh cleanly, then re-link it — this often resolves stale policy state issues without needing a full CAP rebuild.