What does NTSTATUS 0xC00002D0 (STATUS_DS_CANT_MOD_PRIMARYGROUPID) mean?

STATUS_DS_CANT_MOD_PRIMARYGROUPID

Meaning and context of STATUS_DS_CANT_MOD_PRIMARYGROUPID

This is not an ordinary edit of a group’s member list. The request attempted to modify the primaryGroupID relationship of a domain-controller account, and Active Directory rejected that change because the account’s role has special directory constraints.

Confirm that the target is a domain controller computer account and review the automation or migration rule that issued the modify operation. A generic account-copy routine can accidentally carry a primaryGroupID value into a target where that attribute must not be changed.

Use explicit, supported group membership and role-management steps for the intended permission change. Do not treat primaryGroupID as a substitute for the normal member/memberOf relationships, and do not attempt to bypass the rejection with a raw LDAP write.

primaryGroupID attribute | AD DS group-type glossary | LDAP schema model (RFC 4512)

Native status interpretation

STATUS_DS_CANT_MOD_PRIMARYGROUPID is 0xC00002D0, an NTSTATUS error value. AllStat describes it as “Cannot change the primary group ID of a domain controller account.”