| Previous | Next |
| STATUS_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN | STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER |
STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN
Meaning and context of STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN
The rejected member is another Domain Local group, and the domain is using the legacy mixed-mode nesting rules. In this mode, a Domain Local group can contain global groups and accounts, but it cannot contain another Domain Local group.
Verify both objects rather than relying on their display names: inspect each group’s scope, the domain that owns it, and whether the request is changing membership on a security or distribution group. A same-name group from another domain is especially easy to misread in administrative tools.
For a modern design, first determine whether the domain configuration is intentionally legacy. Native-mode rules still do not allow a Domain Local group to contain a Domain Local group from another domain or forest, so raising the mode would not make every cross-domain nesting request valid.
Mixed-mode nesting rules | Native-mode nesting rules | AD DS group-type glossary
Native status interpretation
STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN is 0xC00002D6, an NTSTATUS error value. AllStat describes it as “In mixed domain, cannot nest local groups with other local groups, if the group is security enabled.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Log the operation associated with ds / nest / localgroup / in / mixeddomain, the object or handle type, process and thread identity, and the state transition immediately before the return.
- When user mode receives this result, capture both the native status and the final Win32/COM error so the translation boundary remains visible.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “In mixed domain, cannot nest local groups with other local groups, if the group is security enabled.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.