NTSTATUS 0xC000017B (STATUS_INVALID_MEMBER): meaning and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The principal exists but its account type is not valid for membership in this local alias.

Previous	Next
STATUS_NO_SUCH_MEMBER	STATUS_KEY_DELETED

STATUS_INVALID_MEMBER

The member object type is incompatible with the group

Membership rules depend on alias scope, domain configuration, and the SID type returned by account lookup. A domain object, deleted-object placeholder, computer, group, or other principal class can be rejected even though its name resolves successfully.

Capture SID_NAME_USE or the SAM object class rather than treating every resolved SID as a user. Choose the correct target group type and supported nesting relationship; converting the name format does not change the underlying account type.

What to inspect

Record the resolved SID type and source domain.
Verify the target alias permits that principal class and nesting scope.
Use a supported intermediary group only when policy and token expansion require it.

References

Looking for a different code? Search another status or error code.