NTSTATUS 0xC0000068 (STATUS_MEMBER_NOT_IN

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The specified principal is not a direct member of the domain group being modified.

Previous	Next
STATUS_MEMBER_IN_GROUP	STATUS_LAST_ADMIN

STATUS_MEMBER_NOT_IN_GROUP

There is no matching direct group membership to remove

A user can receive effective access through nested groups or another domain relationship while still not being a direct member of this group. Group-removal APIs operate on the direct membership set and therefore cannot remove an indirect path by naming the user here.

Resolve both SIDs and enumerate direct membership before changing it. If the goal is to remove effective access, trace all nested groups and ACL entries rather than assuming one failed removal means the user has no access.

What to inspect

Enumerate direct group members and compare SIDs.
Separate direct membership from nested or token-expanded membership.
Recalculate effective access after modifying the correct membership path.

References

Looking for a different code? Search another status or error code.