STATUS_INVALID_TOKEN (0xC0000465) Fix – Token Expired in Windows

You're staring at an app crash or a command line error with 0xC0000465, and that's a dead giveaway your user token is expired or corrupted.

I ran into this last week with a client’s QuickBooks installation—wouldn't open, just threw the token error. After an hour of digging, I found the real fix. Skip the registry edits and driver reinstalls. Here's what actually works.

The Short Fix (Works 90% of the time)

Open Command Prompt as Admin. Hit Windows key, type cmd, right-click, choose "Run as administrator".
Stop the Local Security Authority Subsystem Service (LSASS). This sounds scary but it's safe—Windows restarts it automatically. Run:
```
net stop lsass
```
Wait 5 seconds. LSASS will restart itself after a few seconds.
Clear the credential cache. In the same admin prompt, run:
```
rundll32.exe keymgr.dll, KRShowKeyMgr
```
This opens the Stored User Names and Passwords dialog. Delete any entries that look stale—especially domain credentials or saved network passwords you don't use anymore.
Force a token refresh. Log off and back on. That regenerates your user token from scratch. If you're in a domain, also run:
```
gpupdate /force
```
to sync Group Policy, which often refreshes the token too.

Why This Works

Windows uses the LSASS process to handle user tokens—think of it as the bouncer at a club. LSASS creates a token when you log in, containing your identity, groups, and privileges. That token has an expiration time built in (often 10-15 hours for normal interactive logins, but can be shorter in terminal sessions or after a password change).

The 0xC0000465 error fires when a program tries to use a token that LSASS already marked invalid—usually because the token was created before a password reset, or because the system ran out of memory and dumped half the token data. By stopping LSASS, you force it to discard all stale tokens. Then clearing the credential cache removes any old stored credentials that could be feeding LSASS bad data.

Had a client last month whose entire print queue died because of this—the print spooler was holding a token from the previous day's login. Same fix.

When the Basic Fix Doesn't Work

Sometimes the token issue is deeper. Here are the uncommon variations:

Corrupted user profile. If logging off and on doesn't help, the profile itself might be damaged. Create a new local admin account (Settings > Accounts > Family & other users > Add someone else) and test the app there. If it works, migrate data and delete the old profile.
Group Policy stomping on tokens. Domain-joined machines can have policies that limit token size or lifetime. Check Event Viewer > Windows Logs > System for LSASS warnings. If you see event ID 5632 or 5661, your domain admin might have locked down token cache time to 15 minutes. That's a policy change, not a client fix.
Third-party security software. I've seen Trend Micro and Bitdefender hook into LSASS and corrupt token generation. Uninstall the AV temporarily, reboot, and test. If the error disappears, reinstall a different security suite.
Memory corruption. Rare, but bad RAM can flip bits in LSASS's token structures. Run Windows Memory Diagnostic (mdsched.exe) if you're getting random token errors across multiple apps.

How to Stop It From Coming Back

Log off daily. If you leave your PC on for weeks, tokens accumulate and age out. A quick logoff every morning prevents 0xC0000465.
Don't use cached credentials for network shares. Uncheck "Remember my credentials" when connecting to NAS boxes or other PCs. Those cached copies can go stale and confuse LSASS.
Keep Windows Updated. Microsoft patched a token-caching bug in KB5022842 (February 2023) that was causing this exact error on Windows 10 22H2. Make sure you're current.
Run a daily credentials sweep. Every few weeks, open Credential Manager (Control Panel > User Accounts > Credential Manager) and delete anything under Windows Credentials that looks old—especially entries with dates before your last password change.

That's it. If you've done these steps and still see 0xC0000465, it's almost certainly a hardware issue or a domain policy you can't bypass. But for everyone else, this fix gets you back in business in under 10 minutes.