Fix 0X00000998: Can't Add User to Accounts Database

If you're seeing error 0X00000998 (NERR_CanNotGrowUASFile) when trying to add a user to a Windows domain or local SAM database, it's frustrating. But the fix is usually straightforward. Let's jump right in.

The Short Fix: Clear Old Accounts or Increase the Database Limit

This error has two main causes — either the database file (usually SAM or UAS) has hit its internal size limit, or the file system it sits on is full. On Windows Server 2008 R2 and later, the SAM file is capped at about 40 MB by default. Once it's full, you can't add new users. The database file itself won't grow automatically. That's by design — it's a security measure to prevent runaway file growth.

Here's what you do:

1. Check disk space on the drive where your SAM file lives. On a domain controller, that's usually C:\Windows\NTDS or C:\Windows\System32\config. Free up space if it's below 10%.
2. Delete unused user accounts or computer accounts. Use Active Directory Users and Computers (if it's a DC) or net user command locally. On a domain controller, run dsquery user -inactive 90 | dsrm -noprompt to remove users inactive for 90 days.
3. Expand the SAM file size limit. This is the fix when deleting accounts doesn't work. You'll need to edit the registry: open regedit and go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. Create a DWORD value named MaximumSamSize (if it doesn't exist) and set it to 0x80000000 (that's 2 GB). Reboot the server.

After you reboot, try adding the user again. You should see the error go away and the account get created.

Why This Works

The SAM (Security Accounts Manager) file is a memory-mapped file. Windows loads the entire SAM into the LSA process memory when it starts. That's why there's a hard limit — Microsoft doesn't want the LSA process to consume too much RAM. The default limit keeps the SAM file small enough that it won't bog down the system. But if you have a legitimate need for more accounts, bumping the limit is safe. The 2 GB cap is more than enough for most organizations.

On older systems (Windows NT 4.0 and earlier), the error came from the UAS (User Accounts System) file, which had a 40 MB hard limit that couldn't be changed. That's why the error code says NERR_CanNotGrowUASFile — it's a legacy message. On modern Windows (Server 2012 through 2022), the real culprit is usually the SAM limit or disk space.

Less Common Variations

Sometimes the error shows up in event logs or in third-party apps that call the NetUserAdd API. Here are a few scenarios I've seen:

• Service account addition fails in a script. A scheduled PowerShell script using New-ADUser might throw this error. The fix is the same — check SAM size or disk space.
• Exchange or SQL Server can't create a user. If those apps try to add a local user for service reasons, they hit the same limit. Apply the registry fix above.
• The error appears on a read-only domain controller (RODC). That's rare, but if the SAM on the RDC fills up, the same steps apply. Just know that the RDC's SAM is a subset of the full one, so deleting accounts on the writable DC will sync down.

Prevention

Don't let your user count creep up without monitoring. Set a baseline: if you're running a domain controller, check the SAM file size once a month. You can do that with PowerShell:

$sam = Get-Item "C:\Windows\NTDS\ntds.dit"
$sam.Length / 1MB

If it's over 30 MB, start planning to clear old accounts or bump the limit. Also, set a retention policy for inactive accounts — disable and delete accounts after 90 days of inactivity. That keeps the database lean.

If you're on an older system like Windows Server 2008 R2 (which is out of support anyway), consider upgrading. Those older versions have stricter limits and you'll hit this error sooner.

One last tip: if you increase the MaximumSamSize registry value, write down the original value somewhere. If you ever need to revert, you'll have it. And test on a non-production server first if you can.