ERROR_INCOMPATIBLE_SERVICE_PRIVILEGE (0x00000511) Fix

Quick answer for advanced users

Run sc sdshow ServiceName to see current security descriptor, compare with a known working service, then use sc sdset to fix it. The real cause is usually a corrupted service security descriptor from a botched security policy update or registry cleaner.

Why this error happens

Error 0x00000511 shows up when Windows tries to start a service but finds that the service's security descriptor — think of it as a permission ticket — doesn't match what the Service Control Manager (SCM) expects. This mismatch stops the service dead in its tracks. I've seen this most often with third-party antivirus services, VPN clients, or Windows Update-related services right after a Windows security patch Tuesday or a Group Policy refresh. The error message itself is vague: 'The service cannot be started because it has an incompatible service privilege level.'

So what's happening under the hood? Every service has a security descriptor that defines who can start, stop, or configure it. When that descriptor gets corrupted or overwritten — say by a registry cleaner that's too aggressive, or a security policy that writes bad data — Windows refuses to run the service. It's not a hardware issue, not a driver issue. It's a permissions problem at the Windows service level.

Main fix: Repair the service security descriptor

1. Open Command Prompt as Administrator. Press the Windows key, type cmd, right-click Command Prompt, and select 'Run as administrator.'
2. Identify the service that's failing. Go to Services (press Win + R, type services.msc, hit Enter), find the service with the error, and double-click it. The Service name is at the top of the Properties window. Write it down — it's case-sensitive. Example: wuauserv for Windows Update.
3. Back in the admin Command Prompt, run sc sdshow ServiceName. Replace 'ServiceName' with the actual name. For example: sc sdshow wuauserv. You'll see a long string like D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;IU)(A;;CCLCSWRPWPDTLOCRRC;;;SU). That's the security descriptor in SDDL format (Security Descriptor Definition Language). Save this output — copy it to a text file.
4. Now grab the security descriptor from a known working service. Pick something basic like Spooler (the Print Spooler). Run sc sdshow Spooler. Copy that output too.
5. Compare the two. A corrupted descriptor often has missing entries for SYSTEM (SY) or Administrators (BA). If the failing service's descriptor is shorter or has strange characters, it's toast. You need to replace it with a known-good descriptor.
6. To fix the failing service, run sc sdset ServiceName "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;IU)(A;;CCLCSWRPWPDTLOCRRC;;;SU)". Replace 'ServiceName' with your service name, and paste in the full descriptor from Spooler (or any working service). Hit Enter. You should see [SC] SetServiceObjectSecurity SUCCESS.
7. After that, try starting the service. Run sc start ServiceName or go back to Services.msc, right-click the service, and choose Start.
8. If it starts, you're good. If not, reboot and try again — sometimes the SCM caches old descriptors until restart.

Alternative fixes if the main one fails

Restore default security descriptor via registry

If sc sdset doesn't work — maybe you get an access denied or the service still fails — the problem might be deeper. Some services have hard-coded default descriptors in the registry. Here's how to restore them:

1. Open Regedit as Administrator. Press Win + R, type regedit, right-click and choose 'Run as administrator.'
2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ServiceName. Replace 'ServiceName' with your service.
3. In the right pane, look for a value named Security. This is a binary blob that stores the security descriptor. You can delete this value — Windows will regenerate it from the service's default template the next time the service starts or the system boots. Right-click Security, choose Delete, confirm Yes.
4. Close Regedit and restart your computer. After reboot, check if the service starts normally.

Use System File Checker and DISM

If the descriptor keeps getting corrupted, there might be system file damage. Run these commands in an admin Command Prompt, one at a time:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

DISM takes 5-15 minutes. SFC takes 15-30 minutes. Both will repair Windows components. After they finish, reboot and try the service again.

Last resort: recreate the service

Some services can be reinstalled. For example, Windows Update service (wuauserv) can be re-registered with:

net stop wuauserv
net stop bits
regsvr32 /s atl.dll
regsvr32 /s urlmon.dll
regsvr32 /s mshtml.dll
net start bits
net start wuauserv

For other services, you might need to uninstall and reinstall the software that owns the service. That's usually the cleanest fix for third-party services like VPN or antivirus apps.

Prevention tip

Stop using registry cleaners. I've seen them corrupt service security descriptors more times than I can count. Windows doesn't need a registry cleaner — it manages its own registry fine. Also, when you apply Group Policy or security updates, always test them on one machine first. A bad policy can overwrite service descriptors across your whole network in minutes. If you run security software, keep it up to date and avoid tools that claim to 'optimize' Windows services by changing their permissions. That's a sure way to trigger error 0x00000511.