| Previous | Next |
| STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER | STATUS_WMI_NOT_SUPPORTED |
STATUS_DS_HAVE_PRIMARY_MEMBERS
Meaning and context of STATUS_DS_HAVE_PRIMARY_MEMBERS
This status exposes a membership relationship that ordinary group views can hide. A user’s primaryGroupID contains the RID of its primary group; that membership is not listed in the user’s memberOf attribute or the group’s member attribute.
Before changing the group from security-enabled to distribution-only, identify accounts whose primaryGroupID equals the group RID. Inspect the group’s SID and the relevant account attributes; checking only explicit members can incorrectly show an empty group.
Move or correct the primary-group relationship through a controlled account-management process before considering conversion. Do not force a raw group-type change, because a security-disabled group is ignored in access-control entries and the directory is protecting an existing security relationship.
primaryGroupID attribute | AD DS primary-group definition | Changing group scope or type
Native status interpretation
STATUS_DS_HAVE_PRIMARY_MEMBERS is 0xC00002DC, an NTSTATUS error value. AllStat describes it as “Cannot change to security disabled group because of having primary members in this group.”
Looking for a different code? Search another status or error code.