What does NTSTATUS 0xC00002D8 (STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER) mean?

STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER

Meaning and context of STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER

The parent is a Global group and the attempted nested member is Universal. Global groups are limited to accounts and Global groups from their own domain; a Universal group can represent membership from across the forest and therefore cannot be placed inside that narrower scope.

Inspect the parent’s GroupScope, the candidate group’s scope, and the domains represented by the candidate’s members. This is not a transient replication problem and it is not fixed by reissuing the same LDAP modify request.

Use a scope that matches the intended direction of membership. Often the valid layout is Global groups nested into a Universal or Domain Local group, not a Universal group nested into a Global group. Any conversion should be checked against existing nesting and access-control impact first.

Native-mode nesting rules | Active Directory security groups | Group scope conversion rules

Native status interpretation

STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER is 0xC00002D8, an NTSTATUS error value. AllStat describes it as “A global group cannot have a universal group as a member.”