Fix NERR_LogonTrackingError 0X00000996 on Windows

What triggers this error

This error pops up when you try to log into a Windows machine, usually a domain-joined PC or server. You see something like "Could not set logon information NERR_LogonTrackingError for this user" with code 0X00000996. It's Microsoft's way of saying the logon tracking system can't save or update your session data. I've seen this most often after a user changes their password on the domain controller, then tries to log into a workstation that still has their old cached credentials. Another common trigger? A corrupted user profile or a permissions screw-up on the profile folder.

Cause #1: Corrupted cached profile (most common)

This is the fix I try first, because it works 80% of the time. Windows keeps a local copy of your profile to speed up logon. If that cached copy gets out of sync with the server (password change, group policy update, or just a bad write), the system chokes when it tries to log you on.

How to fix it

1. Reboot the machine into safe mode with networking. Press F8 during boot, or hold Shift while clicking Restart from the login screen.
2. Log in as a different admin account (local Administrator works if it's enabled).
3. Go to C:\Users and look for the user's profile folder (like C:\Users\jdoe). Rename it to something like C:\Users\jdoe.old. Don't delete it yet—you might need files from it later.
4. Open Registry Editor (regedit). Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.
5. Look for a key with a long SID string (like S-1-5-21-...). Click each one and check the value of ProfileImagePath on the right. Find the one pointing to the user's old path (C:\Users\jdoe). Right-click that key, rename it by adding .old to the end, or delete it if you're sure you don't need it.
6. Reboot normally. Have the user log in. Windows will create a fresh profile from scratch.

Last month I had a client whose whole sales team got this after a forced password reset. Renaming the profiles on their laptops fixed every single one. Did it take a few minutes per machine? Yeah. But it worked.

Cause #2: Permissions issue on the user profile folder

If the first fix didn't work, check folder permissions. Sometimes a previous admin or a bad script changes ownership on the profile folder. The tracking system can't write to the profile, so it throws error 0X00000996.

How to fix it

1. Boot into safe mode with command prompt (or use another admin account).
2. Open an elevated Command Prompt (right-click, Run as administrator).
3. Run this command to take ownership of the user's profile folder:
   

   takeown /f "C:\Users\jdoe" /r /d y

4. Then grant full control to the user:
   

   icacls "C:\Users\jdoe" /grant jdoe:(OI)(CI)F /t

5. Reboot and try logging in.

I've seen this happen when someone migrated user data from an old PC and the permissions got mangled. The takeown and icacls commands are your friends here. Don't skip the /t flag—it applies to all subfolders.

Cause #3: Corrupted user registry hive (NTUSER.DAT)

This one's less common but nasty. The file NTUSER.DAT in the profile folder holds the user's registry settings. If it's damaged, the logon tracking can't load it, and you get the error.

How to fix it

1. Boot into safe mode as admin.
2. Navigate to C:\Users\jdoe. Rename NTUSER.DAT to NTUSER.DAT.old. You might see hidden files—turn on "Show hidden files" in File Explorer.
3. Reboot. Windows will create a default NTUSER.DAT from the default user profile. The user will lose personal settings (desktop theme, etc.) but their files stay.

I had a case where a junior admin deleted NTUSER.DAT thinking it was a temp file. Big mistake. But renaming it and letting Windows rebuild it is a solid fix.

Quick-reference summary table