What does NTSTATUS 0xC000A087 (STATUS_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS) mean?

STATUS_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS

The OID-mapped group cannot have members

An OID-mapped group is used as a mapping object for an object identifier, not as a normal security or distribution group whose membership list is directly administered.

This status prevents callers from treating that mapping object like a conventional group. If an application needs authorization groups, create or use a proper AD group and keep OID mapping separate.

What to inspect

• Confirm that the target object is an OID-mapped group rather than a normal security group.
• Remove membership-management automation from that object class.
• Use the related OID lookup evidence when the failure is part of certificate, claims or authentication-mapping work.

References

• Microsoft: system error codes for DS OID statuses
• Microsoft Open Specifications: NTSTATUS values
• Microsoft: Active Directory security groups