Windows error 8609 (ERROR_DS_CANT_MOVE_APP_QUERY

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A non-empty query-based application group cannot be moved across domain boundaries.

Previous	Next
ERROR_DS_CANT_MOVE_APP_BASIC_GROUP	ERROR_DS_ROLE_NOT_VERIFIED

ERROR_DS_CANT_MOVE_APP_QUERY_GROUP

ERROR_DS_CANT_MOVE_APP_QUERY_GROUP (8609) is an Active Directory Domain Services error. The directory service rejected a cross-domain move of a query-based application group. The group query, domain scope, and member resolution context must be recreated for the destination domain instead of being directly moved.

What to check

Export the query definition and document the expected result set before changing the group.
Recreate the group and its query in the target domain with destination-specific naming and search scope.
Validate application authorization against the new group before removing the original one.

Useful command

Get-ADGroup -Identity "<ApplicationGroup>" -Properties *

Microsoft: Understand Active Directory security groups · Microsoft: Move-ADObject · Microsoft: Directory Service system error codes

Looking for a different code? Search another status or error code.