What does Windows error code 8506 (ERROR_DS_CANT_MOD_PRIMARYGROUPID) mean?

 
Previous Next
ERROR_DS_SENSITIVE_GROUP_VIOLATION ERROR_DS_ILLEGAL_BASE_SCHEMA_MOD

ERROR_DS_CANT_MOD_PRIMARYGROUPID

ERROR_DS_CANT_MOD_PRIMARYGROUPID (8506) is an Active Directory Domain Services error. The operation attempted to change the primary group ID of a domain controller account. This attribute is controlled by Active Directory for DC accounts and changing it manually would undermine directory security and role assumptions.

What to check

  • Confirm that the target is a domain controller computer account, not a normal user or member server account.
  • Review the script or identity-management workflow that attempted the update.
  • Use supported domain-controller promotion, demotion, and group-management operations instead of changing primaryGroupID.

Useful command

Get-ADComputer -Identity "<DomainController>" -Properties primaryGroupID

Microsoft: Demote domain controllers and domains · Microsoft: Characteristics of AD attributes · Microsoft: Directory Service system error codes

Looking for a different code? Search another status or error code.