When This Error Pops Up
You're working on a Windows Server 2019 box, maybe 2016 or 2022. You try to log in via Remote Desktop, and it kicks you back with error 0x00000556. Or you're running some single sign-on (SSO) software like Okta, and after a user logs in, the app crashes with this exact code. I've even seen it with custom authentication DLLs on terminal servers. The error means Windows thinks the logon session ID is already taken by another process. It's not a hardware fail—it's a session management glitch.
Root Cause in Plain English
Windows uses a unique ID for each logon session. When something goes wrong—like a rapid logout/login sequence or a buggy authentication provider—the system tries to assign an ID that's still in use. It's like someone grabbed the last parking spot but didn't leave. The LSA (Local Security Authority) can't clear the old session fast enough. This usually happens when:
- You have multiple RDP sessions from the same user.
- Third-party auth software doesn't clean up properly.
- Windows updates mess with session handling (I had a client whose print server died after KB5005573).
Step-by-Step Fix
Step 1: Kill Stuck Sessions
Open PowerShell as admin. Run query session to see all logon sessions. Look for sessions in a "Disc" or "Active" state that shouldn't be there. Then force-kill them with:
logoff <sessionID> /server:<computername>Replace <sessionID> with the number from the list. For local use, just logoff 1 (session ID 1 is usually the console). If the session won't die, restart the Terminal Services service: net stop TermService & net start TermService.
Step 2: Clear the LSASS Cache
Sometimes the LSA (Local Security Authority Subsystem Service) holds onto old session IDs. Reboot the machine. That's the nuclear option, but it works 90% of the time. If you can't reboot (production server), run:
lsm.exe /clearNote: This command is available on Windows Server 2016+ but requires you to stop the LSM service first. Safer to just schedule a reboot during maintenance.
Step 3: Check Authentication Providers
If the error came after installing SSO software, disable it temporarily. Go to Control Panel > Credential Manager > Windows Credentials, and remove any stale entries. Also check the registry at HKLM\SYSTEM\CurrentControlSet\Control\Lsa for extra Authentication Packages—remove any that aren't standard (like msv1_0). Back up the key first.
Step 4: Fix RDP Session Limits
Open gpedit.msc (or secpol.msc for local policy). Go to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections. Set Restrict Remote Desktop Services users to a single Remote Desktop Services session to Enabled and set Limit number of connections to 1. That stops session ID collisions from multiple RDP logins.
Step 5: Update or Roll Back
If this started after a Windows update, check the installed updates in Settings > Update & Security > View update history. Uninstall recent ones related to authentication (like KB4571694 on Server 2016). Reboot after removal.
What If It Still Fails?
If you've tried all that and the error persists, look at Event Viewer under Windows Logs > Security. Filter for Event ID 4625 (logon failure) or 4648 (explicit credential). The details might show a specific process or user account causing the collision. Also check if you have duplicate domain-joined machines with the same SID—that's rare but happens with bad sysprep images. Use PsGetSid.exe from Sysinternals to compare. If nothing worked, back up and clean install Windows. I know it's drastic, but sometimes the session database gets corrupted and no fix can touch it.