| Previous | Next |
| STATUS_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN | STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER |
STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER
Meaning and context of STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER
A Global group is an account-oriented scope: its members must come from its own domain, and nested group members must also be Global groups from that domain. A Domain Local group represents resources in a particular domain, so putting it inside a Global group would reverse the intended scope direction.
Check the parent group’s scope and the candidate member’s scope before changing permissions. The useful distinction is between membership design and resource assignment: a Domain Local group can consume Global or Universal groups, but a Global group cannot consume a Domain Local group.
Correct the nesting direction or redesign the access model around the resource domain. Changing the parent to Domain Local or Universal is a separate architectural decision; it must be evaluated against the group’s current members, memberships, ACL use, and conversion restrictions.
Native-mode nesting rules | Active Directory security groups | Group scope conversion rules
Native status interpretation
STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER is 0xC00002D7, an NTSTATUS error value. AllStat describes it as “A global group cannot have a local group as a member.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Log the operation associated with ds / global / cant / have / local, the object or handle type, process and thread identity, and the state transition immediately before the return.
- When user mode receives this result, capture both the native status and the final Win32/COM error so the translation boundary remains visible.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “A global group cannot have a local group as a member.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.