ERROR_SECRET_TOO_LONG (0x00000566): 3 Fixes for LSA secret over limit

1. The real problem: LSA secrets have a 512-byte limit

What's actually happening here is that Windows stores credentials and configuration secrets in a protected area called the LSA (Local Security Authority) secrets store. Each secret — like a stored VPN password or a domain controller trust relationship — has a hard cap of 512 bytes. When you hit 0x00000566, some application or service tried to write a secret that's bigger than that.

I've seen this most often when someone configures a netsh credential with a long password, or when an enterprise app like a backup service pushes a huge configuration string into LSA. On Windows 10 and 11, it's rarer but still happens with custom scripts that call LsaStorePrivateData with oversized data.

The fix is straightforward: find the bloated secret and either trim it or delete it. But the hard part is finding which secret is too long.

2. The most common cause: netsh credential with a long password

This gets people on Windows 10 and Windows Server 2019+ all the time. You run something like:

netsh credential add targetname="SomeVPN" type=generic username="admin" password="a_very_long_password_that_exceeds_512_characters..."

And boom — error 0x00000566. The password plus the target name together go over the 512-byte limit.

How to fix it

1. Delete the offending credential with this command. Replace the targetname with whatever you used:

netsh credential delete targetname="SomeVPN" type=generic

2. Re-create it with a shorter password — under 100 characters to be safe. The secret's total size includes the target name, the username, and the password, so keep the password short.
3. Verify it's gone by listing credentials:

netsh credential show all

The reason this works is that netsh credential stores data in the LSA secrets store under the key L$_SomeVPN. Once you delete it, the slot is free.

3. Second cause: Registry-based LSA secret (less common, but trickier)

Some applications write secrets directly to the registry under:

HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets

The SECURITY hive is protected, so you can't browse it normally. But you can use PsExec from Sysinternals or Regedit running as SYSTEM to get in. I've seen this with old backup agents and custom security tools.

How to fix it — the safe way

1. Download PsExec from Microsoft Sysinternals. Open an admin command prompt.
2. Launch Regedit as SYSTEM:

psexec -i -s regedit.exe

3. Navigate to HKLM\SECURITY\Policy\Secrets. You'll see a list of keys like NL$KM, L$_SomeApp, etc.
4. Look for a secret with a huge CurrVal or OldVal binary entry. Right-click the parent key and select Export to save it first — safety net.
5. Delete the key that's clearly oversized (compare the binary size in hex — if it's over 0x200 bytes, that's 512 decimal).

Important: Don't delete keys you don't recognize. Some are critical, like NL$KM (machine key for Netlogon). If you delete the wrong one, the machine may lose domain trust.

4. Third cause: Domain controller trust secret too long

On Windows Server (2016, 2019, 2022), a domain controller's trust relationship with another domain uses LSA secrets for the shared password. If you run into 0x00000566 when creating or resetting a trust, the issue is that the system-generated secret is too long. This is rare — I've only seen it once, on a cross-forest trust between two huge organizations.

How to fix it

1. Open Active Directory Domains and Trusts.
2. Right-click the trust you're working with, go to Properties, then the Trust tab.
3. Click Reset or Validate — this regenerates the secret with a shorter token.
4. If reset fails, remove the trust and re-create it. Use a simple trust name (under 50 chars) and avoid special characters.

The reason this happens is that certain domain/forest names with long netbios names (like CORPORATE-HEADQUARTERS-US at 27 chars) combined with the password generation algorithm can push the secret past 512 bytes. Shortening the domain name won't help after creation, but re-creating the trust with a simpler name will.

Quick-reference summary

That's it. The key takeaway: keep your credentials under 500 bytes total. If you're writing custom code that calls LsaStorePrivateData, cap the input at 400 characters to leave room for the key name overhead.