| Previous | Next |
| STATUS_DS_UNIVERSAL_CANT_HAVE_LOCAL_MEMBER | STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER |
STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER
Meaning and context of STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER
The attempted member belongs to a different domain from the Global group. A Global group is constrained to accounts and Global groups from its own domain, even when trust relationships allow authentication and resource access across domains.
Verify the member’s distinguished name and SID domain, not only its resolved name. A request can look local in a management console while the referenced principal comes from a child, parent, or trusted domain.
For cross-domain resource access, use a scope that permits the required direction of membership, commonly a Domain Local group in the resource domain or a Universal group where the forest design supports it. Keep the change separate from ACL changes so the resulting token and access path can be reviewed.
Native-mode nesting rules | Active Directory security groups | Security principals and SIDs
Native status interpretation
STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER is 0xC00002DA, an NTSTATUS error value. AllStat describes it as “A global group cannot have a cross domain member.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Compare the exact ds / global / cant / have / crossdomain operation on a working system and record differences in object lifetime, access token, device state, negotiated protocol, and policy.
- For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with this result.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “A global group cannot have a cross domain member.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.