What does NTSTATUS 0xC0000358 (STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER) mean?

STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER

Meaning and context of STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER

An account group is the directory terminology for a Global group. This status therefore expresses the same scope direction as the Global-group rule: a Global group cannot contain a Universal group, even though the Universal group may contain Global groups from domains in the forest.

Confirm the actual groupType of both objects before changing the request. Names such as “global” or “enterprise” in a group label do not establish the AD scope; the directory attributes do.

Reverse the nesting direction when the goal is to aggregate domain-specific Global groups for forest-wide use, or select a Domain Local group for resource assignment. Do not change scope without reviewing existing members and parent memberships because Global-to-Universal conversion has documented prerequisites.

AD DS group-type glossary | Active Directory security groups | Group scope conversion rules

Native status interpretation

STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER is 0xC0000358, an NTSTATUS error value. AllStat describes it as “A account group cannot have a universal group as a member.”