What does NTSTATUS 0xC00002D4 (STATUS_DS_INVALID_GROUP_TYPE) mean?

STATUS_DS_INVALID_GROUP_TYPE

Meaning and context of STATUS_DS_INVALID_GROUP_TYPE

This is a directory-object validation failure, not an ACL denial. Active Directory stores both group scope and whether the object is security-enabled in its group metadata. A provisioning client that writes a malformed or incompatible value can fail before the directory evaluates any proposed member.

Inspect the target object’s objectClass, groupType, GroupScope, and GroupCategory. Compare the exact LDAP modify request or automation payload with the intended result: Domain Local, Global, and Universal scopes are distinct states, while distribution and security groups differ in whether they can appear in access-control entries.

Do not repair this by substituting an arbitrary numeric groupType value or by changing members first. Establish the desired scope and category, then correct the operation that creates or modifies the group. If the object is managed by synchronization, find the source rule that supplied the invalid value.

Active Directory security groups | AD DS group-type glossary | LDAP schema model (RFC 4512)

Native status interpretation

STATUS_DS_INVALID_GROUP_TYPE is 0xC00002D4, an NTSTATUS error value. AllStat describes it as “The specified group type is invalid.”