| Previous | Next |
| ERROR_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER | ERROR_DS_STRING_SD_CONVERSION_FAILED |
ERROR_DS_HAVE_PRIMARY_MEMBERS
Primary-group references still depend on the group SID
Primary membership is not represented by an ordinary value in the group’s member attribute. A user’s primaryGroupID stores the RID of the primary group, and token construction treats the user as a member even when normal membership enumeration does not show that link. Converting such a group to a distribution group would remove security semantics while accounts still depend on its SID.
Search users and computers whose primaryGroupID equals the group’s RID, then assign an appropriate replacement primary group before changing the security bit. Do not rely only on the group’s visible member list or memberOf backlinks. After changes, verify token membership and access on a newly authenticated session because existing tokens can retain the old group SID.
What to inspect
- Extract the RID from the group objectSid.
- Search primaryGroupID rather than only member/memberOf.
- Reauthenticate test accounts after moving their primary group.
References
- Microsoft: primaryGroupID attribute
- MS-ADTS: primary-group semantics
- Microsoft: security-enabled groupType flag
Looking for a different code? Search another status or error code.