| Previous | Next |
| STATUS_MEMBER_NOT_IN_GROUP | STATUS_WRONG_PASSWORD |
STATUS_LAST_ADMIN
The account store is preventing administrative lockout
Disabling, deleting, or restricting the final administrator can leave the machine or domain without a supported management path. SAM therefore protects certain account transitions when they would make administration impossible.
Do not bypass the check by corrupting the account database or editing offline metadata. Establish another tested administrator, verify its logon and recovery capabilities, and only then repeat the intended change. In a domain, also consider replication and emergency-access procedures.
What to inspect
- Enumerate enabled administrator-capable accounts in the target scope.
- Test interactive or remote administration with the replacement account.
- Preserve a documented break-glass path before disabling or deleting the account.
References
- Microsoft Open Specifications: SAM Remote Protocol
- Microsoft: Default Active Directory accounts
- Microsoft: NetUserDel
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.