| Previous | Next |
| ERROR_NO_SUCH_MEMBER | ERROR_TOO_MANY_SIDS |
ERROR_INVALID_MEMBER
The local-group API rejected the member’s principal type
Local-group and group membership APIs accept specific categories of security principals. ERROR_INVALID_MEMBER means the referenced object exists, but its account type is wrong for the requested membership operation. This is different from ERROR_NO_SUCH_MEMBER and from duplicate-membership statuses; retrying with the same SID and a different spelling will not change the principal type.
Query the resolved principal type and the destination object type. Code that mixes global-group and local-alias APIs is especially suspect because SAMR models groups and aliases separately and their membership methods take different identifier forms. If the application performs generic principal selection, validate type before issuing the membership change and explain the unsupported combination to the caller.
What to inspect
- Record the resolved SID and account type of the proposed member.
- Verify whether the destination is a group or local alias and use the matching API family.
- Reject unsupported principal types before repeatedly calling the membership API.
References
Looking for a different code? Search another status or error code.