STATUS_SECRET_TOO_LONG (0xC0000157) Fix: Secret Exceeds Max Length

Quick answer for advanced users

Clear Kerberos tickets with klist purge, then delete overlong secrets in Registry under HKLM\SECURITY\Policy\Secrets or reset Windows Credential Manager. Reboot after.

What this error is and why you're seeing it

The STATUS_SECRET_TOO_LONG error (0xC0000157) means some secret—a password, encryption key, Kerberos ticket, or registry value—exceeded 512 bytes. That's the hard limit in Windows for stored secrets. You'll see this mostly in three places:

• Domain-joined computers after a password change or group policy update. The Kerberos ticket cache gets a ticket that's too big.
• Web browsers or apps that store credentials in Windows Credential Manager. Some saved passwords blow past the limit.
• Custom software or scripts that write to LsaStorePrivateData or registry Secrets with a value larger than 512 bytes.

I've seen this on Windows 10 22H2 and Windows Server 2022 after a domain admin changed a service account password to a 40-character random string that got wrapped in encryption overhead. The real fix is finding where the oversized secret lives and either trimming it or wiping it out.

Step 1: Purge Kerberos tickets (most common fix)

1. Open Command Prompt as Administrator. Click Start, type cmd, right-click Command Prompt, choose Run as administrator.
2. Type klist purge and press Enter. You should see: Current LogonId is 0:0x... Deleting all tickets... Then purge succeeded.
3. Close the command prompt. Reboot your computer.
4. After reboot, try the operation that gave you the error. If it's gone, that was it. If not, move to Step 2.

Step 2: Clear Windows Credential Manager

1. Open Control Panel. Click Start, type control panel, press Enter.
2. Click User Accounts, then Credential Manager.
3. Click Windows Credentials (not Web Credentials).
4. Look for any credential that seems long or suspicious—generic credentials with long names, or entries from apps that you don't use anymore.
5. Click the arrow next to each one, then click Remove. Confirm when prompted.
6. Repeat for Certificate-Based Credentials if any are listed.
7. Close Control Panel. Reboot.

Step 3: Check and trim registry secrets (advanced)

Do this only if steps 1 and 2 didn't help. Messing up registry secrets can break domain authentication.

1. Open Regedit as Administrator. Click Start, type regedit, right-click it, Run as administrator.
2. Navigate to: HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. You'll see subkeys like $MACHINE.ACC or custom names.
3. Click each subkey. Look at the CurrVal and OldVal values. If any binary data exceeds 512 bytes, that's your problem.
4. Right-click the offending subkey, choose Export to back it up, then delete the subkey.
5. Close Regedit. Reboot.

Step 4: Alternative fix—reset credential cache via disk cleanup

If you can't find the source, nail it with a broader reset:

1. Open Disk Cleanup as Administrator. Click Start, type cleanmgr, right-click, Run as administrator.
2. Select the system drive (usually C:).
3. Click Clean up system files.
4. Check Delivery Optimization Files, Windows Upgrade Log Files, and Recycle Bin.
5. Also check Temporary files—this often clears credential cache leftovers.
6. Click OK, then Delete Files.
7. Reboot.

Step 5: Prevention—keep secrets under 512 bytes

Make sure any passwords or keys you store in Windows—whether via Group Policy, service accounts, or scripts—stay under 512 bytes in their stored form. That includes the encryption overhead that Windows adds. A 40-character password usually stays safe, but a 100-character password can push past the limit after encryption. If you're writing custom code with LsaStorePrivateData, test with a short string first. For domain admins: avoid overly long service account passwords. Stick to 20–30 characters, mixed case and symbols. That'll keep you under the wire.

One last thing—if you're still seeing the error after all this, check Event Viewer under Windows Logs > System for event ID 4096 or 4097. Those logs often tell you exactly which secret is too long. Filter by source KDC or LSASS.