Fix NERR_InvalidDatabase (0X000008C7) on Windows domain join

When you see this error

You're trying to join a Windows 10 Pro machine (or Windows Server 2019) to a domain. You enter the domain name, click OK, and after a few seconds you get 0X000008C7: The security database is NERR_InvalidDatabase corrupted. No fancy error messages, just this one. It happens most often after you've already joined and left the domain once, or after a failed sysprep.

What's actually happening

The Security Accounts Manager (SAM) is a registry hive under HKEY_LOCAL_MACHINE\SAM. It stores local user accounts and their SIDs. When you join a domain, Windows writes a new machine account password into this hive. If the SAM is corrupted — a bad block, a leftover lock from a previous domain session, or a recent driver update that messed with the registry — Windows can't write to it. So it throws 0X000008C7.

The reason you see NERR_InvalidDatabase is that the NetApi32.dll function NetJoinDomain calls NetpGetDomainJoinInfo, which hits the SAM directly. If the SAM returns garbage (corrupted) or says "I'm busy" (locked), the function gives up and returns this error code. It's not a network problem — it's local to the machine.

The fix

Skip the BIOS resets and SFC scans. Here's what actually works:

1. Back up the SAM registry hive (just in case):
   Open Command Prompt as Admin. Run mkdir C:\SAMBackup && reg save HKLM\SAM C:\SAMBackup\SAM.hiv. This saves the current state so you can restore if you mess up.
2. Take ownership of the SAM key (you need this even if you're admin):
   Run regedit, browse to HKEY_LOCAL_MACHINE\SAM. Right-click -> Permissions -> Advanced -> Change owner to Administrators. Apply. Then grant Administrators Full Control. Close regedit.
3. Delete the old domain settings inside SAM (if they exist):
   Still in cmd as admin, run reg delete HKLM\SAM\SAM\Domains\Account /va /f then reg delete HKLM\SAM\SAM\Domains\Builtin /va /f. This clears the domain-specific SIDs and machine account password from the SAM. If the keys don't exist, that's fine — move on.
4. Reboot and try the domain join again:
   After reboot, go to System Properties -> Computer Name -> Change -> Domain. Enter your domain name and credentials. The SAM is now clean, so Windows can write the new machine account.

What if it still fails?

If the error comes back, the SAM file itself might be physically corrupted on disk. In that case:

• Run chkdsk C: /f and reboot — this fixes bad sectors that might corrupt the hive.
• If chkdsk doesn't help, you need to rebuild the SAM. Best way: use systemreset --factoryreset (keep your files) or reinstall Windows clean. Yes, it's a pain, but it's faster than chasing ghosts.
• Windows 11 machines with BitLocker enabled sometimes trigger this if the SAM hive is encrypted but the boot key got rotated. Decrypt the drive first, then try the domain join.

One last thing: if you're joining a domain that uses a different time zone or NTP server, the Kerberos pre-auth might fail and Windows reports this as a database error. Double-check the time on the machine — sync it with w32tm /resync before retrying.