| Previous | Next |
| ERROR_MEMBER_NOT_IN_GROUP | ERROR_WRONG_PASSWORD |
ERROR_LAST_ADMIN
Windows rejected an account operation that could eliminate administrative access
This status is a protection condition, not a generic access-denied result. Account-management code attempted to disable, delete, or otherwise make an administrative account unusable in a state where doing so could leave the system without a usable administration account. Built-in and administrator-related principals also have well-known identities and special handling in Windows security.
Before retrying, inventory the actual administrative principals and their enabled state on the target machine or domain. Creating a normal user is not enough unless that principal has the required administrative membership and can log on under current policy. Do not work around the protection by editing the SAM database directly; account APIs are the supported boundary and preserve security-database consistency.
What to inspect
- Identify the account operation: delete, disable, password change, or membership change.
- Verify another enabled administrative principal can actually authenticate and administer the target.
- Use supported account and group APIs rather than offline SAM modification.
References
Looking for a different code? Search another status or error code.