| Previous | Next |
| ERROR_DS_NO_NEST_LOCALGROUP_IN_MIXEDDOMAIN | ERROR_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER |
ERROR_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER
The member scope is broader than a global group can accept
A global group represents principals from its own domain and can itself be used throughout the forest or trusted environments. A domain-local group is designed to collect principals for permissions within its own domain and can contain members from broader locations. Placing a domain-local group inside a global group would invert those scope rules and make token evaluation ambiguous.
Inspect the scope bits of both objects; names such as “Local” or “Global” are not reliable evidence. A common authorization design is to place same-domain accounts in global groups, nest those into domain-local groups, and assign resource permissions to the domain-local group—not the reverse. If conversion is considered, first verify every existing member and parent relationship against the target scope.
What to inspect
- Decode the parent and member groupType values.
- Reverse the nesting direction when following account/global/domain-local design.
- Validate all transitive memberships before changing scope.
References
- Microsoft: group-scope membership matrix
- MS-ADTS: global and domain-local groups
- Microsoft: constraints on scope conversion
Looking for a different code? Search another status or error code.