When This Error Actually Shows Up
You'll see 0x00000537 most often during domain login on Windows 10/11 or Server 2019/2022 — right after the user enters credentials, the screen flashes then drops back to the login prompt. Happens with Service Accounts too: a scheduled task or service fails to start, and the Event Viewer logs the error as 0x00000537 (ERROR_INVALID_SUB_AUTHORITY) under Security-Auditing. I've also seen it when someone tries to grant folder permissions via an SID that doesn't match the AD domain anymore — usually after a domain migration or a botched user profile deletion.
Root Cause — Plain English
Windows uses Security Identifiers (SIDs) to track users and groups. A SID has two parts: the domain authority (which identifies the domain or local machine) and the relative ID (RID) plus sub-authorities. Error 0x00000537 means the sub-authority part of the SID — the bits that specify which domain or forest issued the SID — is garbage. The culprit here is almost always a corrupt registry key under HKEY_USERS or a stale SID in Active Directory that doesn't match any existing domain trust.
For local accounts, it's usually a damaged user profile. For domain accounts, it's a referencing issue: maybe the SID points to a domain that no longer exists, or someone manually edited the ProfileGuid or ProfileList registry keys. Don't bother rebuilding the WMI repository or running SFC — that's not the problem here.
Step-by-Step Fix
Step 1: Identify the bad SID
Open Event Viewer, go to Windows Logs > Security, and find the event with 0x00000537. Note the account name and SID shown in the details. If you can't see the SID there, run this in PowerShell (as admin):
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList'
| Where-Object { (Get-ItemProperty $_.PSPath).ProfileImagePath -match 'username' }Replace username with the account that's failing. Note the SID folder (something like S-1-5-21-...).
Step 2: Check for orphaned registry entries
Still in the ProfileList key, look for subkeys that have a ProfileImagePath pointing to a path that doesn't exist. These are orphaned profiles. Export the whole ProfileList key as a backup first, then delete the orphaned subkey. Reboot the machine and try logging in again.
If the profile path exists but the SID is corrupt — you'll know because the State value shows 0 instead of 1 (active) — you can sometimes fix it by setting State to 0, deleting the RefCount value, then rebooting. That forces Windows to rebuild the profile association.
Step 3: Fix domain SID references (for domain accounts)
When the account is from a trusted domain, make sure the domain trust still works. Run nltest /trusted_domains from an elevated command prompt. If the domain is missing, the SID sub-authority gets confused. You'll need to re-establish the trust — talk to your AD team. If the trust is fine but the SID is still corrupt, delete and recreate the computer account in AD (disjoin/rejoin). Yes, it's a pain, but it's the fastest path.
Step 4: Reset the user profile (last resort)
If steps 1-3 don't work, rename the user profile folder in C:\Users, remove the registry entry in ProfileList, and log in fresh. Windows will create a new profile and assign a clean SID. Move old data manually from the renamed folder. Don't copy the NTUSER.DAT — that file carries the corruption.
What to Check If It Still Fails
If you're still getting 0x00000537 after all that, check the Security ID (SID) History attribute in Active Directory. During domain migrations, old SID values get orphaned. Use Active Directory Users and Computers to view the user's Attribute Editor — look for sidHistory. If it contains a SID from a domain that's gone, clean it out with ADSI Edit. That's rare but I've seen it break service accounts on Server 2016 and newer.
One more thing: if this is a service account, check the
Log On Assetting in the service properties. If the account name has a trailing space or special character, Windows can't resolve the SID correctly. Remove the space and re-enter the password. You'd be surprised how often that's the cause.