| Previous | Next |
| ERROR_DS_NO_NEST_GLOBALGROUP_IN_MIXEDDOMAIN | ERROR_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER |
ERROR_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN
The domain mode blocks nesting of security-enabled local groups
Domain-local membership rules depend on domain operating mode. In mixed mode, a security-enabled domain-local group is limited to user members, so nesting another local or directory group is rejected. The same membership can be legal after the domain operates in native mode, subject to ordinary domain-local scope constraints.
Read the parent group scope, candidate member scope, and domain mode from the same authoritative domain controller. Do not confuse a domain-local Active Directory group with a machine-local SAM group; they are stored and evaluated differently. If the nesting is being used to grant resource access, document the intended account-to-global-to-domain-local chain before choosing whether to raise domain mode or restructure groups.
What to inspect
- Distinguish domain-local AD groups from local groups on a server.
- Confirm mixed mode is the reason for the restriction.
- Review the permission assignment that depends on the proposed nesting.
References
- MS-ADTS: domain-local mixed-mode rules
- Microsoft: domain-local membership rules
- Microsoft: group scope and authorization
Looking for a different code? Search another status or error code.