| Previous | Next |
| ERROR_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER | ERROR_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER |
ERROR_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER
A forest-wide group cannot import a domain-bound local group
Universal groups are represented forest-wide through the global catalog and can contain users, global groups, and universal groups from the forest. A domain-local group is meaningful for authorization in its own domain and may contain principals from trusted domains. Embedding that domain-bound object in a universal group would violate the universal membership model.
Confirm the member is an Active Directory domain-local group, not a computer-local group. Reconsider the authorization direction: universal groups can normally be members of domain-local groups, allowing forest-wide identities to receive permissions in the resource domain. Avoid converting the domain-local group until all of its members and parent memberships are checked, because a single domain-local member can make conversion invalid.
What to inspect
- Verify the candidate group’s scope from groupType.
- Use universal-inside-domain-local nesting for resource-domain permissions.
- Audit nested members before any scope conversion.
References
- Microsoft: universal group membership
- MS-ADTS: universal and domain-local definitions
- Microsoft: conversion restrictions
Looking for a different code? Search another status or error code.