Windows error 8548 (ERROR_DS_LOCAL_MEMBER_OF_LOCAL

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: a domain-local group may join another local group only in its own domain.

Previous	Next
ERROR_DS_GC_REQUIRED	ERROR_DS_NO_FPO_IN_UNIVERSAL_GROUPS

ERROR_DS_LOCAL_MEMBER_OF_LOCAL_ONLY

The parent local group belongs to a different domain

Domain-local groups can be members of other domain-local groups only when both are in the same domain. The restriction keeps resource-domain authorization local and prevents a domain-bound group from becoming part of another domain’s local-group hierarchy. Accounts, global groups, and universal groups provide the supported cross-domain membership paths.

Compare the domain SID prefixes and group scopes of the child and parent. If permissions are assigned in the destination domain, place source accounts into a global or universal group and nest that into the destination domain-local group. This design preserves ownership of the resource ACL and avoids dependence on a foreign domain-local group whose membership semantics are controlled elsewhere.

What to inspect

Confirm both groups have domain-local scope.
Verify they belong to the same domain SID namespace.
Use global or universal groups to bridge domains.

References

Looking for a different code? Search another status or error code.