STATUS_SERVER_SID_MISMATCH 0xC00002A0 Fix

You're seeing STATUS_SERVER_SID_MISMATCH (0xC00002A0) and clients can't connect — that's frustrating, but it's usually a quick fix.

Step-by-step fix

Follow these steps in order. Don't skip ahead; each one builds on the last.

1. Identify the affected service

Look at the error source. If it's coming from a Windows service, find its name:

Get-WmiObject Win32_Service | Where-Object { $_.State -eq 'Running' -and $_.StartName -like '*\*' } | Select-Object Name, StartName, ProcessId

You should see a list of services and their logon accounts. Note the service name you're troubleshooting. If the error comes from a custom app, check its config for a service name or SID.

2. Check the service account SID

Run this in an elevated PowerShell:

$service = Get-WmiObject Win32_Service -Filter "Name='YourServiceName'"
$account = $service.StartName
$sid = (New-Object System.Security.Principal.NTAccount($account)).Translate([System.Security.Principal.SecurityIdentifier])
$sid.Value

You'll get something like S-1-5-21-...-1001. Write it down. This is the SID the service runs under.

3. Compare with what the client expects

If you have the client's config, find the expected SID. For example, in a config file look for ServerSID or RequiredSID. If you don't have it, check the registry on the server:

reg query "HKLM\SOFTWARE\YourApp" /v RequiredSID

The output shows the SID the client wants. If it's different from step 2, that's your mismatch.

4. Fix the mismatch

You have two options:

Change the service account to match the required SID. Use Services.msc or sc config:

sc config YourServiceName obj= "NT AUTHORITY\NetworkService" password= ""

After changing, restart the service:

Restart-Service YourServiceName

You should see the service start without errors. If it fails, check Event Viewer under Windows Logs > System for SID-related errors.

Update the client config to expect the current SID. Edit the config file and replace the old SID with the one from step 2. Save and restart the client app.

5. Verify the fix

Try connecting from the client again. If it works, you're done. If not, check for cached credentials or stale tokens. Reboot both server and client if needed. Sometimes a simple reboot clears the mismatch.

Why this works

STATUS_SERVER_SID_MISMATCH happens when the server process's security identifier (SID) doesn't match what the client expects. SIDs are unique per account or machine. If the service runs under a different account than the client's config, the client rejects the connection. By aligning the SIDs, you restore trust.

Less common variations

Variation 1: SID changed after a restore

If you restored a server from backup, the machine SID might differ. Check with whoami /user. If it's different, you'll need to rejoin the domain or use sysprep /generalize carefully. This is rare but happens after imaging.

Variation 2: Service runs under a virtual account

Virtual accounts like NT SERVICE\YourService have SIDs derived from the service name. If you renamed the service, the SID changes. Recreate the service with the original name or update the client.

Variation 3: Cluster or load-balanced environment

In a cluster, each node's service might run under a different SID. Ensure all nodes use the same service account. Use a domain account instead of local accounts.

Prevention

Document the service account SIDs for all critical services.
Use consistent service accounts across servers, especially in clusters.
After any restore or rename, verify SIDs match client expectations.
Monitor Event Viewer for SID-related warnings.

That's it. Fix the SID, restart the service, and your clients will connect again.