| Previous | Next |
| ERROR_DS_INVALID_GROUP_TYPE | ERROR_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN |
ERROR_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN
Mixed mode does not support this global-group nesting pattern
In mixed mode, Active Directory preserves compatibility with older domain-controller behavior. Security-enabled global groups are consequently restricted to user members and cannot contain another global group. This differs from a modern native-mode domain, where same-domain global-group nesting is supported.
Check the domain mode on the DC that processes the membership write and inspect both the parent and candidate member groupType values. Moving the nested group to another scope is not automatically safe: universal and domain-local groups have different membership and permission reach. If legacy controllers no longer exist, evaluate a controlled functional-mode change; otherwise flatten the membership or redesign the authorization chain.
What to inspect
- Confirm the domain is actually operating in mixed mode.
- Verify both groups are security-enabled global groups.
- Model access-token impact before flattening or converting nested groups.
References
- MS-ADTS: global-group mixed-mode rules
- Microsoft: group-scope membership table
- Microsoft: groupType scope bits
Looking for a different code? Search another status or error code.