| Previous | Next |
| STATUS_DS_LOCAL_CANT_HAVE_CROSSDOMAIN_LOCAL_MEMBER | STATUS_WMI_NOT_SUPPORTED |
STATUS_DS_HAVE_PRIMARY_MEMBERS
Meaning and context of STATUS_DS_HAVE_PRIMARY_MEMBERS
This status exposes a membership relationship that ordinary group views can hide. A user’s primaryGroupID contains the RID of its primary group; that membership is not listed in the user’s memberOf attribute or the group’s member attribute.
Before changing the group from security-enabled to distribution-only, identify accounts whose primaryGroupID equals the group RID. Inspect the group’s SID and the relevant account attributes; checking only explicit members can incorrectly show an empty group.
Move or correct the primary-group relationship through a controlled account-management process before considering conversion. Do not force a raw group-type change, because a security-disabled group is ignored in access-control entries and the directory is protecting an existing security relationship.
primaryGroupID attribute | AD DS primary-group definition | Changing group scope or type
Native status interpretation
STATUS_DS_HAVE_PRIMARY_MEMBERS is 0xC00002DC, an NTSTATUS error value. AllStat describes it as “Cannot change to security disabled group because of having primary members in this group.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Compare the exact ds / have / primary / members operation on a working system and record differences in object lifetime, access token, device state, negotiated protocol, and policy.
- For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with this result.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “Cannot change to security disabled group because of having primary members in this group.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.