Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Windows error 0x00000565, usually shown as ERROR_TOO_MANY_SECRETS, means that the system has reached its maximum number of stored Local Security Authority (LSA) secrets. A secret can belong to a Windows service, scheduled task, IIS application pool, computer account, or sign-in feature. The safest fix is to identify the component trying to create another secret, remove or replace only a credential that is demonstrably obsolete, then restart and test that component. Do not begin by deleting registry keys at random.
What error 0x00000565 means
Microsoft defines ERROR_TOO_MANY_SECRETS with the message: “The maximum number of secrets that can be stored in a single system has been exceeded.” The code describes a capacity condition in Windows’ Local Security Authority (LSA) secret store. An operation that needs to save another protected secret is being refused because the store has reached its system limit.
As an Amazon Associate I earn from qualifying purchases.
This message does not, by itself, prove that Windows system files are corrupt, that malware is present, or that one particular registry key is damaged. The useful clue is the action that failed immediately before the code appeared: starting a service, registering a scheduled task, configuring IIS, authenticating to a domain, connecting a mapped resource, or another operation that saves credentials.
Free tools Windows power users keep installed
One-click scans. No signup required.
What counts as an LSA secret
LSA secrets are protected data intended to be accessible only to processes running as the SYSTEM account. Windows can store them encrypted on disk because they support automatic logon, service startup, and other background operations. Examples documented by Microsoft include:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- The computer-account password used by a computer joined to Active Directory Domain Services.
- Passwords assigned to Windows services.
- Passwords saved for configured scheduled tasks.
- Credentials for IIS application pools and websites.
- Microsoft-account passwords and related sign-in data.
These entries are operational credentials, not disposable cache files. Removing one without identifying its owner can stop a service from starting, make a scheduled task fail, break an IIS site, or cause repeated authentication prompts. Treat every candidate as required until the owning account, task, service, or application has been confirmed.
First, capture the failure context
Before changing anything, write down the exact hexadecimal code, the complete message, the time, and the action that produced it. A short record often identifies the owner of the attempted secret.
- Record the trigger. Note whether the error appeared while creating or editing a service, starting a service, creating a scheduled task, changing an IIS application pool, joining a domain, connecting a mapped drive, or signing in.
- Record the account involved. Capture the service logon account, scheduled-task user, application-pool identity, domain account, or Microsoft account shown by the configuration dialog.
- Check whether the failure is repeatable. Do not repeatedly submit a form that creates new credentials if each attempt could add another entry or leave another stale configuration behind.
- Preserve evidence. Save screenshots, the task name or service name, and relevant Event Viewer entries before making changes.
If the triggering component is unknown, use the inventories below rather than attempting a global cleanup.
Inventory possible owners with supported Windows tools
Windows services
Press Win+R, enter services.msc, and press Enter. Sort or search for the service involved in the failure. Open its Properties dialog and inspect the Log On tab. Record the service name, startup type, and account. Look for services belonging to software that has been uninstalled, renamed, replaced, or migrated to a different account.
Do not delete a service merely because its display name is unfamiliar. Confirm its executable path, publisher, installation record, and whether another application still depends on it. If a service is obsolete, use the software’s uninstaller or the vendor’s documented removal procedure. If the service is still needed, replace its password through the service properties or the vendor’s supported configuration tool instead of deleting an LSA entry.
Scheduled tasks
Open taskschd.msc (Task Scheduler). In Task Scheduler Library and its subfolders, inspect tasks created by the application or account associated with the error. Open each likely task and review:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- General: the user account and whether the task is configured to run whether or not that user is logged on.
- Triggers: whether the task is still needed and how often it runs.
- Actions: the executable and arguments, which can reveal software that no longer exists.
- History: recent registration, logon, or launch failures.
Export a task before editing it by selecting the task, choosing Export, and saving the XML file. For a task that is still required, open Properties, set the correct account, enter its current password when prompted, and apply the change. For a task left by software that has been removed, verify that no replacement component uses it before disabling and deleting it.
IIS websites and application pools
On a server running Internet Information Services, open IIS Manager with inetmgr. In Application Pools, inspect the pool associated with the site. Open Advanced Settings and check Identity. A custom account may have a password stored for the pool. Also inspect the site’s authentication and connection settings if the failure occurred while publishing or changing a website.
For an active site, coordinate a credential change with the application owner. Update the account password in the approved identity-management process, then update the application pool identity and recycle the pool. Deleting a credential without changing the pool configuration will normally turn a capacity problem into an application-startup failure.
Credential-management interfaces and mapped resources
Open Control Panel, choose User Accounts, then Credential Manager. Review Windows Credentials for entries belonging to a server, share, application, or account that has been retired. Remove an entry only after confirming that it is not used by a script, service, scheduled task, backup job, or mapped drive.
If the error occurred while connecting a mapped resource, identify the exact server name and account. Disconnect the obsolete mapping through File Explorer > This PC or the organization’s normal management tool, then remove only the matching saved credential. A credential-management entry is not automatically the same thing as every LSA secret, so deleting entries at random may not reduce the count and can still remove a credential that a user or service needs.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsDomain and computer-account operations
If the message appeared during a domain join, trust repair, or computer-password change, involve the domain administrator before altering local credentials. The computer account password is an LSA secret used for secure-channel authentication. Check the computer name, domain membership, time synchronization, and secure-channel status with your organization’s approved tools. A local cleanup cannot safely substitute for repairing a domain account or trust relationship.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Back up configuration before changing a credential
Make a recovery plan before removing or replacing anything:
- Export scheduled tasks that may be affected and save the XML files in a protected location.
- Document service names, executable paths, startup types, dependencies, and logon accounts.
- Record IIS site and application-pool settings, including the identity account and bindings.
- Confirm that you can sign in with an administrator account and that you have a tested way to restore the affected service or task.
- For business systems, schedule the change so an application owner can test logon, scheduled processing, and web requests immediately afterward.
Do not begin with a registry export followed by deletion of unknown LSA-related subkeys. A registry backup does not make an incorrect deletion safe, and LSA secrets are protected in ways that are not intended for casual manual editing.
Remove or replace only a confirmed obsolete secret
When a service is obsolete
First uninstall the owning application or use its documented cleanup utility. If the service remains after the application is removed, verify that no task, script, or dependent service calls it. Disable it, restart the computer or service as appropriate, and observe whether the original operation succeeds. Delete a service only through supported Windows administration or vendor instructions, keeping the service configuration record for rollback.
Recommended Free Tools
When a service is still required
Change the account password in the organization’s identity system, then enter the new password on the service’s Log On tab in services.msc. Restart the service and check its recovery actions and dependencies. If the account has been replaced, switch to the approved replacement account rather than creating another duplicate service entry.
When a scheduled task is obsolete
Export the task, disable it, and monitor the system for the next scheduled interval or business cycle. If nothing depends on it, delete it from Task Scheduler. If it is needed, update its account and password in Properties and run it manually with Run to verify that it can log on and complete its action.
When an IIS identity is obsolete or changed
Confirm which site and pool use the identity. Update the pool’s identity through IIS Manager, recycle the pool, and test the site locally and from a client. Keep the previous configuration until the application has passed its authentication and database-connection checks.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
When a credential-management entry is obsolete
Remove only the matching entry from Credential Manager after confirming its target and account. Reconnect the resource using the correct account if it is still needed. If the entry belongs to a shared script or scheduled task, update that owner first; otherwise the next run may fail with a logon error.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →When low-level LSA private data is genuinely involved
Microsoft documents the LsaStorePrivateData function for LSA private-data operations. Its documented deletion behavior is that passing a NULL private-data value deletes the private data and its key. Microsoft also cautions that LSA private-data functions should be used only when necessary for documented LSA-secret work.
This API is intended for software and administrators who understand the owning secret, required privileges, and recovery procedure. It is not a recommendation to enumerate and erase unknown secrets. If a vendor application created the secret, obtain that vendor’s instructions or support before using an LSA API. A wrong key can remove a credential that Windows needs for startup or authentication.
Restart and verify the original operation
- Restart the affected service, scheduled task, application pool, or computer according to the change you made.
- Repeat the exact operation that produced
0x00000565, using the same account and settings. - Check Event Viewer through
eventvwr.msc. Review Windows Logs > System, Windows Logs > Application, and the relevant operational log for the service, Task Scheduler, or IIS. - Confirm the practical outcome: the service remains running, the task completes, the site serves a request, the mapped resource reconnects, or the domain operation finishes.
- If the error returns, stop deleting entries. Identify the component that is still attempting to create a secret and compare its current configuration with the backup you made.
Choose a remediation path by risk and supportability
| Approach | Use it when | Support and rollback | Main risk |
|---|---|---|---|
| Correct the owning service, task, or application configuration | You can identify the component and its account | Uses the component’s normal settings; restore the documented account or exported task | Incorrect password or account can stop startup |
| Remove a verified obsolete service, task, or credential | The software or account is confirmed retired | Export or document configuration first; reinstall or import if needed | A hidden dependency may fail later |
| Use a vendor cleanup or repair procedure | A third-party application owns the secret | Usually includes vendor-specific rollback guidance | Generic cleanup may not understand the application |
| Use an LSA private-data API | A documented LSA-secret operation is required and the owner is known | Requires a tested backup and recovery plan | Deleting the wrong key can break authentication or startup |
| Delete arbitrary registry entries | There is no safe general case for this approach | Registry export alone is not a reliable rollback | Unsupported deletion can cause outages or sign-in failures |
Is the Windows LSA secret limit 256?
A third-party troubleshooting page repeats a limit of 256 secrets and recommends registry cleanup. Microsoft’s public error-code reference and authentication documentation cited for this issue do not state one universal numeric limit. Therefore, 256 should not be treated as a guaranteed threshold for every Windows edition, version, or configuration.
The reliable conclusion is only that the system has exceeded the maximum applicable to its secret store. Counting entries manually, deleting a fixed number, or applying a registry recipe copied from another Windows version can target the wrong data. Base the repair on the component that generated the new secret and on documentation for that component.
What to do when the error persists
The same service or task fails after cleanup
Restore the configuration from your export or notes, then review the account’s password, rights, expiration, and policy restrictions. Check whether the application is repeatedly creating uniquely named services or tasks on every run. Contact the application vendor with the exact error, Windows edition and build, component name, and Event Viewer entries.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
The error occurs during domain or sign-in work
Stop local secret removal and involve a domain administrator. Verify secure-channel, account, and time-synchronization conditions using your organization’s procedures. A domain computer password or sign-in credential can affect many users and services.
The failure is on an IIS server
Capture the site name, application-pool name, identity account, and IIS event entries. Have the web-application owner validate database and network credentials after any identity change. Keep the previous pool configuration until all sites using that pool have been tested.
No owner can be identified
Use Event Viewer timestamps, Task Scheduler history, service executable paths, IIS configuration, and recent software-change records to correlate the failed operation. If the source remains unknown, obtain Microsoft or vendor support rather than performing broad deletion. Preserve the system state and your backups so an investigator can reproduce the issue.
Preventive credential hygiene
Remove services and scheduled tasks as part of application uninstall procedures, review task libraries after migrations, and keep a current inventory of service and application-pool accounts. Retire credentials through the owning product or Windows interface, not by deleting unrelated registry data. Separate administrative accounts from application identities where policy allows, and document who owns each noninteractive credential.
Tools that scan source repositories and collaboration platforms for exposed passwords, API keys, and tokens can reduce the chance of credential leakage, but that preventive work is different from repairing ERROR_TOO_MANY_SECRETS. Such scanning does not free capacity in the Windows LSA store.
Quick Recap
As an optional shortcut after you have identified the failing component, Outbyte PC Repair can attempt fixes for more than 100 common Windows issues, clean temporary and cache files, review certain Windows settings and missing updates, and provide tools such as real-time boost, file shredder, and crash logging. It complements antivirus software rather than replacing it; results vary, and no tool repairs every failure. It runs on Windows 11, 10, 8, and 7, with a free trial by category for at least two days before a paid subscription.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
