| Previous | Next |
| ERROR_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER | ERROR_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER |
ERROR_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER
Global-group membership must remain within its own domain scope
Universal groups can aggregate accounts and groups from anywhere in the forest. Global groups, by contrast, accept accounts and global groups from their own domain. Nesting a universal group inside a global group would import forest-wide membership into a domain-scoped container, so Active Directory rejects it.
Verify that the candidate member is truly universal and not merely named as one. Usually the valid direction is to place global groups inside a universal group, or to place either inside a domain-local group used for resource permissions. Converting the parent to universal can be appropriate only after checking that it is not participating in relationships that block conversion and that global-catalog replication cost is acceptable.
What to inspect
- Read groupType for both groups from the directory.
- Evaluate reversing the nesting direction.
- Check universal-group replication and conversion constraints before changing scope.
References
- Microsoft: global and universal membership rules
- MS-ADTS: universal and global group definitions
- Microsoft: changing group scope
Looking for a different code? Search another status or error code.