| Previous | Next |
| STATUS_DS_INVALID_GROUP_TYPE | STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN |
STATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN
Meaning and context of STATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN
This code identifies a legacy mixed-mode domain restriction. In that mode, a global security group can contain accounts from its own domain, but it cannot contain another global group, a universal group, or an account from another domain.
Check the target group’s scope, the candidate member’s object type and domain, and the domain functional configuration. The same nesting can be legal for a native-mode domain but still be rejected in a mixed-mode domain, so a generic “group membership failed” diagnosis loses the important condition.
Do not convert a group to Universal solely to bypass the error. A scope conversion has its own preconditions and can affect where the group SID is useful for access control. Decide whether the intended design should remain legacy-compatible or whether a planned functional-level and scope review is appropriate.
Mixed-mode nesting rules | Native-mode nesting rules | Group scope and conversion
Native status interpretation
STATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN is 0xC00002D5, an NTSTATUS error value. AllStat describes it as “In mixed domain no nesting of global group if group is security enabled.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Log the operation associated with ds / nest / globalgroup / in / mixeddomain, the object or handle type, process and thread identity, and the state transition immediately before the return.
- For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with this result.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “In mixed domain no nesting of global group if group is security enabled.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.