STATUS_INVALID_SERVER_STATE (0xC00000DC) Fix Guide

What's going on with 0xC00000DC?

You're staring at an error that says the Security Accounts Manager (SAM) server's in the wrong state. Translation: Windows can't authenticate users because the SAM service or its backing store is hosed. This usually hits on domain controllers (Server 2016, 2019, 2022) but I've seen it on standalone servers too. The culprit here is almost always a corrupt registry hive, a broken LSASS service, or disk corruption on the system drive.

Don't bother reinstalling Windows yet — we fix this in-place 9 times out of 10. Let's go cause by cause.

1. Corrupt SAM registry hive

This is the most common cause. The SAM hive (C:\Windows\System32\config\SAM) got corrupted — maybe from a bad shutdown, a failing hard drive, or a botched Windows update. When the SAM service tries to read it, it just sees garbage and throws 0xC00000DC.

Fix: Restore the SAM hive from backup.

Windows keeps automatic backups of registry hives in C:\Windows\System32\config\RegBack. But here's the catch — on many systems, these backups are empty or very old. You'll need to check.

1. Boot into Windows Recovery Environment (WinRE). Hold Shift while clicking Restart, or boot from installation media and choose Repair your computer.
2. Open Command Prompt from Troubleshoot > Advanced Options.
3. Type cd C:\Windows\System32\config
4. Rename the corrupt hive: ren SAM SAM.old
5. Copy the backup: copy C:\Windows\System32\config\RegBack\SAM C:\Windows\System32\config\SAM
6. If the file is 0 bytes or missing, you don't have a good backup. Try the second fix below.
7. Reboot and test.

If it works, you're golden. If not, move to the next cause.

2. LSASS service stopped or corrupted

The Local Security Authority Subsystem Service (LSASS) is what actually talks to the SAM service. If LSASS is down, the SAM server can't do anything. Common triggers: a recent security policy change, a busted group policy, or malware screwing with LSASS.

Fix: Repair LSASS and reset security settings.

1. Boot into Safe Mode with Networking. Press F8 during startup (or use WinRE > Troubleshoot > Advanced > Startup Settings).
2. Open an admin Command Prompt and run sfc /scannow. This checks system files including LSASS.
3. If SFC finds corruption but can't fix it, run DISM /Online /Cleanup-Image /RestoreHealth
4. Next, check the service: sc query lsass — should show STATE as RUNNING. If stopped, run sc start lsass
5. If LSASS won't start, check its dependencies: sc qc lsass — it should depend on RPCSS and SamSs. Try starting SamSs manually: sc start SamSs
6. Reboot and try logging in. If the error persists, move to the next fix.

Pro tip: If you're on a domain controller, you might need to seize FSMO roles or demote and re-promote. But that's a last resort — try the disk fix first.

3. Disk corruption on the system drive

Bad sectors on the boot drive can corrupt the SAM hive or LSASS executable mid-operation. This shows up weird — sometimes it works, sometimes it doesn't, and 0xC00000DC appears randomly. You'll often see Event ID 3096 or disk errors in the System log.

Fix: Run chkdsk with repair.

1. Boot into WinRE (same as fix 1).
2. Open Command Prompt.
3. Identify your system drive: wmic logicaldisk get caption, volumename — usually C: but could be different.
4. Run: chkdsk C: /f /r /x — the /f fixes errors, /r finds bad sectors, /x forces the volume offline.
5. Wait. This can take hours on a large drive. Let it finish.
6. Reboot. If chkdsk reports bad sectors, replace the drive — it's dying.

If none of these work, you're looking at a corrupt domain controller that needs demotion or a full OS repair. But 95% of the time, one of the above fixes it.

Quick-Reference Summary