| Previous | Next |
| ERROR_DS_INSUFFICIENT_ATTR_TO_CREATE_OBJECT | ERROR_DS_CANT_MOVE_APP_BASIC_GROUP |
ERROR_DS_GROUP_CONVERSION_ERROR
The group does not satisfy the target-scope constraints
Changing group scope is not a simple flag replacement. Active Directory evaluates the group’s members, the groups that contain it, domain mode, and the requested path. Global and domain-local groups cannot be converted directly into each other; the supported route passes through universal scope, with constraints applied at each step.
Inventory direct members and parent groups before changing groupType. For universal-to-global conversion, remove members from other domains; for universal-to-domain-local conversion, remove parent relationships that are invalid for a domain-local group. Test the effect on ACLs and access tokens, and perform the conversion as explicit stages rather than writing the final bitmask in one low-level modify.
What to inspect
- List direct members and groups containing the group.
- Validate each intermediate scope in the conversion path.
- Preserve the security-enabled bit unless a distribution conversion is intentional.
References
- Microsoft: changing group scope or type
- Microsoft: scope conversion table
- Microsoft: groupType representation
Looking for a different code? Search another status or error code.