How to fix Error 680 on Windows 11

by

Troubleshooting Guide: Error 680 – GUID Substitution Failure

Why This Error Happens

This error occurs when Windows attempts to translate a Global Unique Identifier (GUID) into a Security Identifier (SID) but cannot locate a registered administrative prefix in Active Directory or the local security database. This typically happens due to a corrupted or incomplete GUID-to-SID mapping table, often resulting from improper Active Directory replication, a damaged local Security Accounts Manager (SAM) database, or an incomplete domain join/trust configuration. Because no defined prefix exists, Windows falls back to a generic substitute prefix to maintain functionality, which may inadvertently apply stricter access controls than originally intended.

Step-by-Step Resolution Guide

  1. Check Event Viewer for Context
    Open Event Viewer (eventvwr.msc) → navigate to Windows Logs > System. Filter for Event ID 680 and note the associated source (usually Security-Kerberos or LSA) and timestamp to identify which service or user triggered the GUID lookup.

  2. Verify Active Directory Trust and Replication (Domain Environments)
    On a Domain Controller, run:

   repadmin /replsummary
   dcdiag /test:NCSecDesc

Resolve any replication errors reported, as broken replication is the most common cause of missing GUID mappings.

  1. Rebuild the Local Security Database Cache
    On the affected Windows 11 machine, restart the Security Accounts Manager and Netlogon services to force a refresh:
   net stop netlogon
   net stop samss
   net start samss
   net start netlogon
  1. Re-establish the Secure Channel with the Domain
    If the machine is domain-joined, reset the secure channel trust using PowerShell (run as Administrator):
   Test-ComputerSecureChannel -Repair -Credential (Get-Credential)

This re-registers the computer’s SID/GUID relationship with the domain controller.

  1. Update Group Policy and Security Settings
    Force a Group Policy refresh to reapply correct security descriptors:
   gpupdate /force

Restart the machine afterward to ensure the new security token is applied cleanly.

Alternative or Verification Steps

  • Verify the Fix: After restarting, check Event Viewer again to confirm Event ID 680 no longer appears during subsequent logon/authentication attempts over a 24-hour period.
  • Alternative Fix: If the issue persists and the machine is domain-joined, disjoin the computer from the domain, restart, and rejoin it. This forces Windows to generate a fresh computer GUID and SID mapping from scratch, eliminating any corrupted legacy references.