Fix 0x8001011A: RPC Security Package Error
This error usually means COM can't find a valid security package. The fix is editing the registry to add Negotiate or Kerberos. I'll show you the exact keys.
You're staring at 0x8001011A and it's killing your app or service.
I've seen this error pop up in Office apps, SQL Server, and custom COM+ applications. The culprit here is almost always a missing or corrupted registry entry for the Negotiate security package. The fix takes 5 minutes.
The Fix: Add Negotiate to the Registry
Open Regedit as Administrator. Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LsaLook for a multi-string value called Security Packages. Double-click it. If you see only kerberos or msv1_0, you're missing negotiate. Add negotiate on a new line. It should look like this:
kerberos
msv1_0
negotiateClick OK, then reboot. That's it for 90% of cases.
Why This Works
COM+ and RPC rely on the Negotiate package to pick the right authentication method (Kerberos or NTLM). Without it, the system throws 0x8001011A because it literally has no good security packages to negotiate with. Adding it back tells Windows, "Hey, use Negotiate to figure this out."
Less Common Variations
Missing Kerberos
If you already have negotiate but not kerberos, add it. Same path, same method. Kerberos is the default for domain-joined machines. Without it, domain authentication fails.
Corrupted LSA Registry Key
Sometimes the whole Lsa key is missing or has wrong permissions. Fix: right-click the Control key, New → Key, name it Lsa. Then create the Security Packages value. Set permissions to allow SYSTEM and Administrators full control.
Group Policy Override
If your domain enforces a different security package list via Group Policy, local reg edits won't stick. Check gpedit.msc under Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options → Network security: Configure encryption types allowed for Kerberos. Make sure Negotiate isn't blocked.
Third-Party Security Software
Some antivirus or endpoint protection tools (like Symantec, McAfee, or CrowdStrike) can strip the Negotiate package. Temporarily disable the software, apply the reg fix, reboot, then re-enable. If the error returns, you'll need to add an exception in that software's policy.
Prevention
Once you've fixed it, don't touch the Security Packages value unless you know what you're doing. Back up the key first. Run this command from an admin prompt to export it:
reg export HKLM\SYSTEM\CurrentControlSet\Control\Lsa LsaBackup.regIf you're rolling out new machines, include this registry setting in your deployment image or via Group Policy Preferences. That way it's there from day one. Also, keep your Windows updated — old builds of Windows 10 (pre-1909) had a known bug that could drop the Negotiate package after a cumulative update.
One more thing: if you're running a stateless app in a container or VM, make sure the base image includes these registry keys. I've wasted hours chasing this on freshly spun-up containers.
That's it. Fix the registry, reboot, error gone.
Was this solution helpful?