What does NTSTATUS 0xC00002DB (STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER) mean?

STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER

Meaning and context of STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER

Domain Local scope is broad for accounts, Global groups, and Universal groups, but it has a specific exception: another Domain Local group can be nested only when both groups belong to the same domain. This code identifies that exception, not a generic trust failure.

Check both group scopes and the domains that own the parent and child. Do not infer the result from whether the domains trust each other; trust can permit authentication while the group-scope containment rule remains invalid.

Redesign the chain so cross-domain membership uses an allowed group type, or move the resource-facing Domain Local group to the domain where it belongs. Avoid scope conversion without checking existing nested groups and ACE usage, because those conversion rules are separate from the membership rule that produced this status.

Native-mode nesting rules | Active Directory security groups | Group scope conversion rules

Native status interpretation

STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER is 0xC00002DB, an NTSTATUS error value. AllStat describes it as “A local group cannot have another cross domain local group as a member.”