| Previous | Next |
| STATUS_DS_GLOBAL_CANT_HAVE_LOCAL_MEMBER | STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER |
STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER
Meaning and context of STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER
The parent is a Global group and the attempted nested member is Universal. Global groups are limited to accounts and Global groups from their own domain; a Universal group can represent membership from across the forest and therefore cannot be placed inside that narrower scope.
Inspect the parent’s GroupScope, the candidate group’s scope, and the domains represented by the candidate’s members. This is not a transient replication problem and it is not fixed by reissuing the same LDAP modify request.
Use a scope that matches the intended direction of membership. Often the valid layout is Global groups nested into a Universal or Domain Local group, not a Universal group nested into a Global group. Any conversion should be checked against existing nesting and access-control impact first.
Native-mode nesting rules | Active Directory security groups | Group scope conversion rules
Native status interpretation
STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER is 0xC00002D8, an NTSTATUS error value. AllStat describes it as “A global group cannot have a universal group as a member.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Log the operation associated with ds / global / cant / have / universal, the object or handle type, process and thread identity, and the state transition immediately before the return.
- When user mode receives this result, capture both the native status and the final Win32/COM error so the translation boundary remains visible.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “A global group cannot have a universal group as a member.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.