| Previous | Next |
| ERROR_DS_INSTALL_NO_SCH_VERSION_IN_INIFILE | ERROR_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN |
ERROR_DS_INVALID_GROUP_TYPE
The scope and security bits form an invalid group type
The groupType attribute is a bit field, but arbitrary combinations are not valid. A normal group has one scope—global, domain local, or universal—and may additionally be security-enabled; distribution groups omit the security bit. System and application-specific flags have separate meanings. Combining mutually exclusive scope bits or supplying an unsupported value causes directory validation to reject the object.
Decode the numeric value rather than treating it as a simple enumeration. Compare the desired scope and security purpose with the existing membership and domain mode. When changing an existing group, use a supported scope transition path and verify that current members and parent groups satisfy the target scope. Writing a corrected integer without checking those relationships can simply expose the next membership constraint.
What to inspect
- Decode every groupType bit in hexadecimal.
- Require exactly one normal AD group-scope flag.
- Validate membership before converting the group scope or security type.
References
- Microsoft: groupType flags
- Microsoft: Active Directory group objects
- Microsoft: supported group scope conversions
Looking for a different code? Search another status or error code.