| Previous | Next |
| STATUS_FILE_DELETED | STATUS_SPECIAL_GROUP |
STATUS_SPECIAL_ACCOUNT
A built-in account cannot be managed like an ordinary account
Built-in accounts and groups use well-known identities and participate in recovery and administrative policy. Some operations that are valid for normal user objects, such as deletion or identity replacement, are intentionally rejected for these special accounts.
Use supported property changes and policy controls rather than attempting to recreate the object. Renaming a built-in account does not change its SID, while deleting and replacing it would break references stored in ACLs and policy.
What to inspect
- Resolve the object SID and determine whether it is a well-known or built-in identity.
- Record the exact SAMR operation and requested information class.
- Apply the documented account-management alternative instead of deleting or cloning the account.
References
- Microsoft Open Specifications: SAM Remote Protocol
- Microsoft: Security identifiers in Active Directory
- Microsoft: Security Identifiers API
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.