| Previous | Next |
| STATUS_JOURNAL_ENTRY_DELETED | STATUS_SYSTEM_IMAGE_BAD_SIGNATURE |
STATUS_DS_CANT_MOD_PRIMARYGROUPID
Meaning and context of STATUS_DS_CANT_MOD_PRIMARYGROUPID
This is not an ordinary edit of a group’s member list. The request attempted to modify the primaryGroupID relationship of a domain-controller account, and Active Directory rejected that change because the account’s role has special directory constraints.
Confirm that the target is a domain controller computer account and review the automation or migration rule that issued the modify operation. A generic account-copy routine can accidentally carry a primaryGroupID value into a target where that attribute must not be changed.
Use explicit, supported group membership and role-management steps for the intended permission change. Do not treat primaryGroupID as a substitute for the normal member/memberOf relationships, and do not attempt to bypass the rejection with a raw LDAP write.
primaryGroupID attribute | AD DS group-type glossary | LDAP schema model (RFC 4512)
Native status interpretation for STATUS_DS_CANT_MOD_PRIMARYGROUPID
STATUS_DS_CANT_MOD_PRIMARYGROUPID is 0xC00002D0, an NTSTATUS error value. AllStat describes it as “Cannot change the primary group ID of a domain controller account.”. For STATUS_DS_CANT_MOD_PRIMARYGROUPID, the first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence for STATUS_DS_CANT_MOD_PRIMARYGROUPID
- Preserve STATUS_DS_CANT_MOD_PRIMARYGROUPID before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Log the operation associated with ds / cant / mod / primarygroupid, the object or handle type, process and thread identity, and the state transition immediately before the return.
- When user mode receives STATUS_DS_CANT_MOD_PRIMARYGROUPID, capture both the native status and the final Win32/COM error so the translation boundary remains visible.
Recovery considerations for STATUS_DS_CANT_MOD_PRIMARYGROUPID
A retry is appropriate only after the owner of STATUS_DS_CANT_MOD_PRIMARYGROUPID has changed the state described by “Cannot change the primary group ID of a domain controller account.”, or when its contract explicitly marks the status as transient. For STATUS_DS_CANT_MOD_PRIMARYGROUPID, if the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.