| Previous | Next |
| STATUS_ONLY_IF_CONNECTED | STATUS_PNP_RESTART_ENUMERATION |
STATUS_DS_SENSITIVE_GROUP_VIOLATION
A protected administrative group membership was modified incorrectly
This status is about privileged group protection, not about ordinary group syntax. Active Directory treats administrative groups as sensitive because their members can control domain controllers, directory configuration or high-value accounts.
A provisioning tool may be allowed to manage normal groups but still fail here. The correct fix is to validate delegated administration and change-control policy, not to bypass the group with raw LDAP writes.
What to inspect
- Identify the target group and whether it is a built-in, domain admin or otherwise protected group.
- Check who issued the change and which delegated rights were expected.
- Review whether AdminSDHolder, protected users or tiered administration policy is involved.
References
- Microsoft: Active Directory security groups
- Microsoft: privileged accounts and groups in AD
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.