| Previous | Next |
| ERROR_DS_LINK_ID_NOT_AVAILABLE | ERROR_DS_MODIFYDN_DISALLOWED_BY_INSTANCE_TYPE |
ERROR_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER
The account-group scope accepts only domain-scoped members
“Account group” is legacy terminology corresponding to the global-group role in Active Directory. Such a group collects accounts and global groups from its own domain. A universal group represents forest-wide membership and therefore cannot be placed inside the account/global group without violating the parent’s domain scope.
Decode the parent groupType rather than relying on legacy labels exposed by an API or migration tool. If forest-wide aggregation is required, reverse the nesting or convert the parent through a supported universal transition after validating all current members. If the group is used for resource permissions, a domain-local group in the resource domain may be the more appropriate parent.
What to inspect
- Map the legacy account-group label to its groupType scope.
- Check the candidate member is universal.
- Choose universal or domain-local nesting in the valid direction.
References
- MS-ADTS: global/account and universal groups
- Microsoft: groupType flags
- Microsoft: group-scope membership matrix
Looking for a different code? Search another status or error code.