| Previous | Next |
| STATUS_DS_GLOBAL_CANT_HAVE_UNIVERSAL_MEMBER | STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER |
STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER
Meaning and context of STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER
A Universal group can contain accounts, Global groups, and other Universal groups from domains in its forest. A Domain Local group is intentionally tied to the domain where resources are assigned, so it is not a valid member of a Universal group.
Check that the object identified by the membership request is actually a Domain Local group, not merely a group located in another domain. Then identify the access pattern: the normal direction is to place Universal and Global groups inside a Domain Local group that protects a resource, rather than place a Domain Local group into a Universal one.
Do not delete and recreate the group to work around this status. Recreating changes the SID and can break ACL references. Change the nesting plan, or perform a supported scope conversion only after checking the documented member and parent-group restrictions.
Native-mode nesting rules | Active Directory security groups | Group scope conversion rules
Native status interpretation
STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER is 0xC00002D9, an NTSTATUS error value. AllStat describes it as “A universal group cannot have a local group as a member.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Correlate this result with ETW, Event Viewer, protocol traces, or a dump from the component that owns ds / universal / cant / have / local; do not diagnose from translated text alone.
- For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with this result.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “A universal group cannot have a local group as a member.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.