Fix ERROR_CANT_ACCESS_DOMAIN_INFO 0x00000547

Quick answer: This error means Windows can't read the domain info from the local SECURITY hive or LSA secrets. The fix is to restore missing registry keys or remove and rejoin the domain.

Why does this happen?

You'll see error 0X00000547 when a domain-joined Windows machine can't pull its own domain account info. It usually pops up when you open the Local Users and Groups snap-in (lusrmgr.msc), or when a service tries to check domain membership. The core problem is almost always a damaged SECURITY registry hive or missing LSA secrets. Common triggers: a failed disk write during an update, a corrupted profile, or someone manually poking around in HKEY_LOCAL_MACHINE\SECURITY.

I've seen this a dozen times—once after a Windows 10 22H2 update that crashed mid-write. Another time after a sysadmin ran a broken script that wiped the domain SID from the registry. The error itself is straightforward: Windows looks for domain info, can't find it, and throws error 0x00000547.

Fix it: Restore domain info and repair the trust

Back up the registry first.
Open regedit.exe as Administrator. Go to HKEY_LOCAL_MACHINE\SECURITY. Right-click SECURITY and choose Export. Save it somewhere safe. If you mess up, you can restore from this backup.
Check the domain SID and LSA keys.
In regedit, expand to HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account. You should see a key called F (binary data) and Names with subkeys. If they're missing or empty, the domain info is gone.
Also check HKEY_LOCAL_MACHINE\SECURITY\Policy\PolDcKey and HKEY_LOCAL_MACHINE\SECURITY\Policy\Accounts. Missing entries here confirm the problem.
Restore the keys from a working backup.
If you have a system restore point from before the error, run rstrui.exe and roll back. After the restore, reboot and check if the error is gone. This works about 70% of the time.
Use the official Microsoft fix: remove and rejoin the domain.
If restoration fails, you need to break and re-establish the trust relationship. Do this:
- Log in with the local Administrator account (or any local account with admin rights).
- Open Settings > Accounts > Access work or school.
- Click Disconnect from the domain. If that option is grayed out, you'll need to force it via command line.
- Open an elevated Command Prompt:
```
netdom remove %computername% /domain:yourdomain.com /UserD:DOMAIN\admin /PasswordD:*
```
- You'll be prompted for the domain admin password. After removal, reboot and join the domain fresh:
```
netdom join %computername% /domain:yourdomain.com /UserD:DOMAIN\admin /PasswordD:* /reboot
```
Repair the LSA secrets manually (advanced).
If you can't rejoin (maybe the domain controller is unreachable), you can try to rebuild the LSA secrets. Download PsPasswd from Sysinternals. Run it with:
```
pspasswd -r -u DOMAIN\admin -p *
```
This forces Windows to reset the machine account password and re-establish the secure channel. After that, reboot and run nltest /sc_verify:yourdomain.com. You should see Status = 0 0x0 NERR_Success.

Alternative fixes if the main one fails

Check the event logs.
Open Event Viewer > Windows Logs > System. Filter by Source NETLOGON or LSASRV. Look for events like 5719 (no domain controller) or 6000 (LSA failure). These pinpoint whether it's a network issue or a local corruption.
Restore the SECURITY hive from Volume Shadow Copy.
If System Restore isn't available, use vssadmin list shadows to find old copies. Mount a shadow copy via mklink /D C:\shadow \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\ and copy the SECURITY file from C:\Windows\System32\config into the live folder. Reboot immediately.
Use a local repair installation.
As a last resort, run an in-place upgrade with a Windows 10 ISO. Boot from it, choose Keep personal files and apps. This rebuilds the registry hives while preserving your data. Takes about an hour, but it's better than a full wipe.

Prevention tips

Never manually edit the SECURITY hive. I don't care what some forum post says—don't do it. Windows locks that hive for a reason. Use local group policy or security templates instead.
Enable System Restore on the system drive. Set it to use at least 5% of the drive. This gives you a safety net when updates go bad.
Take regular registry backups via reg export HKLM\SECURITY C:\backup\security_backup.reg and store them on a network share. Automate it with Task Scheduler if you're managing multiple machines.
Keep your domain controllers healthy. If the DC is flaky, even a good local machine will throw domain errors. Monitor with dcdiag regularly.

If none of these steps work, you're looking at a clean OS reinstall. That's rare—I've only seen it three times in ten years. But when the SECURITY hive is so broken that even an in-place upgrade fails, a fresh start is the only way. Back up your data first.