| Previous | Next |
| ERROR_SPECIAL_GROUP | ERROR_MEMBERS_PRIMARY_GROUP |
ERROR_SPECIAL_USER
The target user has operating-system-defined account semantics
This status is the user-object counterpart to ERROR_SPECIAL_ACCOUNT and ERROR_SPECIAL_GROUP. SAMR exposes user objects through ordinary open, query, set and delete patterns, but Windows can protect particular built-in users from generic operations. The presence of a normal-looking account name does not make such a principal equivalent to an application-created local user.
Use the SID and account flags to identify the principal and log the exact operation that failed. If automation is trying to enforce a baseline, model protected built-in users as a separate class rather than repeatedly issuing delete or conversion operations. A replacement account with the same display name has a different SID and will not inherit the protected user’s security references.
What to inspect
- Identify the user by SID and query its account information.
- Treat protected built-in users separately in desired-state account automation.
- Do not delete and recreate a same-named user to bypass the status.
References
Looking for a different code? Search another status or error code.