What does NTSTATUS 0xC00002E5 (STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY) mean?

STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY

Meaning and context of STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY

The object being added is itself a Domain Local group. Such a group may be nested only inside another Domain Local group from the same domain; it cannot become a member of a Global or Universal group, and it cannot be nested as a Domain Local group across domains.

Inspect the direction of the operation. Administrators often validate the parent’s allowed members but overlook the inverse rule about where the candidate group may itself be a member. Both scope values and both owning domains matter.

Keep resource-domain grouping at the end of the nesting chain. If the design requires aggregation across domains, use Global or Universal groups for that aggregation and reserve Domain Local groups for assigning access in the resource domain.

Native-mode nesting rules | Active Directory security groups | AD DS group-type glossary

Native status interpretation for STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY

STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY is 0xC00002E5, an NTSTATUS error value. AllStat describes it as “A local group can only be a member of other local groups in the same domain.”. For STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY, the first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.

Debugging sequence for STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY

• Preserve STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
• Log the operation associated with ds / local / member / of / local, the object or handle type, process and thread identity, and the state transition immediately before the return.
• For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY.

Recovery considerations for STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY

A retry is appropriate only after the owner of STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY has changed the state described by “A local group can only be a member of other local groups in the same domain.”, or when its contract explicitly marks the status as transient. For STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY, if the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.

Looking for a different code? Search another status or error code.