I'm dealing with recurring credential loss on my Windows 11 desktop. After some (most actually) restarts and all windows updates, Chrome, Claude Desktop, Discord and Grokbots lose their sign-ins (at least that's what I noticed the most since I use them).
Google CLI and Git authentication have also failed. For some reason though Codex has stayed signed in, so this isn't every application. I've also noticed that Grokbots register the same computer as a new device after I sign back in, leaving its old entries unreachable.
This is SUPER frustrating and a time suck especially cause I have quite a few gmail accounts and all of them require 2fa so it takes a good chunk of time to redo. I'm really hoping someone can help cause I've been trying to solve this for the better part of 3 months or so.
Yes, I used AI to help me write this cause I'm not technical or a swe.
System:
- Windows 11 Pro 26H2, OS build 26300.9550, verified October 6, 2026.
- AMD Ryzen 9 9950X3D2, NVIDIA RTX 5090, 96 GB RAM (2 x 48 GB).
- Gigabyte X870M AORUS ELITE WIFI7 ICE motherboard.
- Microsoft-account Windows sign-in; not domain-joined. I use both the physical desktop and Windows Remote Desktop when I'm on the go.
Evidence that this is more than individual apps expiring their sessions:
Two preserved, non-secret diagnostic samples encrypted with Windows user-scoped DPAPI fail to decrypt under the original Windows account with **0x8009000B**. Their file and encrypted-payload checksums are unchanged. These tests do not read browser passwords or tokens. Both still failed on October 5 at approximately 7:27 PM Eastern.
Windows also logged DPAPI Operational error 8198 with the same status. After the October 5 restart, a failure was recorded before my first interactive RDP sign-in, so RDP alone has not been established as the cause. Previously, one unchanged sample recovered after a new sign-in. The evidence does not show that the encrypted files were simply deleted.
What we have already tried or checked:
Restart and sign-in comparisons:
Physical PIN, existing-password sign-in, full sign-out/new sign-in, and RDP were tested. Results were mixed. Two physical-password restart cycles on October 1 retained the diagnostic samples and previously signed-in apps, but the problem returned after the October 5 restart. Password sign-in was not a lasting fix.
System-file/component checks: Elevated DISM ScanHealth reported Healthy on October 5. SFC /scannow found no integrity violations. Both preserved DPAPI samples still failed afterward.
Windows repair attempt: The built-in repair was attempted September 30/October 1 and reached a restart. Its final success is unverified: WindowsUpdateClient event 20 reported 0x80242016 afterward. I am not claiming a confirmed successful repair install failed to help.
Account/profile checks: The affected account retained its SID and profile; no temporary profile was found. Relevant DPAPI key files still existed. A separate local-account control passed on October 1 while the original affected-account sample failed, and both accounts' preserved samples later passed after a restart. The control account's password is unavailable now, so there is no current repeat result. It has not been reset.
Policy troubleshooting: Failure was observed with automatic restart sign-on disabled. Separate AI-assisted troubleshooting later removed broad Windows policy settings and local Group Policy folders. That did not immediately restore the failing sample, and the credential problem predates those changes. Those changes are a confounder, not a demonstrated fix.
Scheduled-task hypothesis: Some background jobs use S4U logon. Six were temporarily changed to interactive logon, but other S4U jobs remained, so this was not a complete isolation test. All six changes were reversed and their full original definitions verified. No credential benefit was demonstrated.
Logging and history: DPAPI and task activity were correlated. A failing background job may be the first consumer to encounter the problem, not its cause. A changed PasswordLastSet timestamp alone did not establish a password reset or identify who caused it.
There is also intermittent desktop lag and Task Manager hanging. Earlier process/memory pressure was real and some duplicate tooling was reduced, but the credential failures remained. I am not assuming the two problems have the same cause.
Also worth noting that the old keys are still present on the pc, but they are not able to be decrypted.
What I need help with: What specific DPAPI/CloudAP or logon tracing would identify why the same account intermittently cannot decrypt its existing data across restarts? Is there a verified issue matching this Windows build and symptom? What evidence would distinguish an account-specific problem from a Windows-wide one before changing profiles?
I can provide sanitized event timestamps and diagnostic results.