| Previous | Next |
| ERROR_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER | ERROR_DS_HAVE_PRIMARY_MEMBERS |
ERROR_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER
Domain-local groups may nest only within their own domain
A domain-local group can accept accounts, global groups, and universal groups from trusted locations, but another domain-local group is eligible only when both groups belong to the same domain. Domain-local authorization is tied to the resource domain, so importing a local group whose meaning is anchored to a different domain is prohibited.
Check the objectSid domain prefix for both groups and identify where the protected resource resides. To carry membership across domains, place the source accounts in a global or universal group and add that group to the destination domain-local group. This preserves the direction of authorization evaluation and avoids copying resource-domain local groups between administrative boundaries.
What to inspect
- Confirm both objects are domain-local groups.
- Compare their domain SID prefixes.
- Bridge domains with global or universal groups instead of cross-domain local nesting.
References
- Microsoft: domain-local membership matrix
- MS-ADTS: domain-local group definition
- Microsoft: group scopes and permission reach
Looking for a different code? Search another status or error code.