| Previous | Next |
| ERROR_DS_LOCAL_MEMBER_OF_LOCAL_ONLY | ERROR_DS_CANT_ADD_TO_GC |
ERROR_DS_NO_FPO_IN_UNIVERSAL_GROUPS
Universal membership cannot use this foreign-principal placeholder
A foreign security principal represents an external SID inside a domain so that trusted identities can participate in local authorization. Universal groups are forest-wide objects replicated through the global catalog. Active Directory does not allow an FSP placeholder to be placed directly in a universal group, because the membership and replication model expects forest-resolvable users and groups.
Inspect the candidate member’s class and SID origin. If the identity belongs to another trusted forest or external domain, place it in a domain-local group in the resource domain, which is designed to accept external principals. If the identity should exist in the current forest, migrate or provision the actual principal rather than treating the FSP as a substitute for an in-forest object.
What to inspect
- Confirm the member objectClass is foreignSecurityPrincipal.
- Identify the SID’s source domain or forest.
- Use a resource-domain local group for external identities.
References
- MS-ADTS: foreign-security-principal constraints
- Microsoft: external members in domain-local groups
- MS-ADTS: universal and domain-local groups
Looking for a different code? Search another status or error code.