| Previous | Next |
| ERROR_DS_SAM_INIT_FAILURE | ERROR_DS_CANT_MOD_PRIMARYGROUPID |
ERROR_DS_SENSITIVE_GROUP_VIOLATION
Protected group membership requires privileged administration
Administrative groups are treated as sensitive security boundaries because adding a member can grant control over the domain or forest. Active Directory protects a defined set of privileged accounts and groups, and their permissions are maintained through the AdminSDHolder/SDProp mechanism. A delegation that works for ordinary organizational-unit groups may therefore be intentionally insufficient for a protected group.
Identify the exact group, whether it is protected directly or through nested membership, and the token used for the write. Review the group’s security descriptor and the AdminSDHolder policy rather than repeatedly adding ACEs to the individual object, because SDProp can restore the protected descriptor. Grant only the narrowly required management right and record the membership change through privileged-access controls and auditing.
What to inspect
- Determine whether the group is in the protected accounts and groups set.
- Inspect effective rights using the actual administrative identity.
- Review AdminSDHolder before changing permissions on the group object.
References
- Microsoft: protected accounts and groups
- Microsoft: AdminSDHolder and SDProp
- Microsoft: security-group administration
Looking for a different code? Search another status or error code.