| Previous | Next |
| STATUS_DS_GLOBAL_CANT_HAVE_CROSSDOMAIN_MEMBER | STATUS_DS_HAVE_PRIMARY_MEMBERS |
STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER
Meaning and context of STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER
Domain Local scope is broad for accounts, Global groups, and Universal groups, but it has a specific exception: another Domain Local group can be nested only when both groups belong to the same domain. This code identifies that exception, not a generic trust failure.
Check both group scopes and the domains that own the parent and child. Do not infer the result from whether the domains trust each other; trust can permit authentication while the group-scope containment rule remains invalid.
Redesign the chain so cross-domain membership uses an allowed group type, or move the resource-facing Domain Local group to the domain where it belongs. Avoid scope conversion without checking existing nested groups and ACE usage, because those conversion rules are separate from the membership rule that produced this status.
Native-mode nesting rules | Active Directory security groups | Group scope conversion rules
Native status interpretation
STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER is 0xC00002DB, an NTSTATUS error value. AllStat describes it as “A local group cannot have another cross domain local group as a member.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Compare the exact ds / local / cant / have / crossdomain operation on a working system and record differences in object lifetime, access token, device state, negotiated protocol, and policy.
- For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with this result.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “A local group cannot have another cross domain local group as a member.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.