| Previous | Next |
| STATUS_DS_GC_REQUIRED | STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS |
STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY
Meaning and context of STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY
The object being added is itself a Domain Local group. Such a group may be nested only inside another Domain Local group from the same domain; it cannot become a member of a Global or Universal group, and it cannot be nested as a Domain Local group across domains.
Inspect the direction of the operation. Administrators often validate the parent’s allowed members but overlook the inverse rule about where the candidate group may itself be a member. Both scope values and both owning domains matter.
Keep resource-domain grouping at the end of the nesting chain. If the design requires aggregation across domains, use Global or Universal groups for that aggregation and reserve Domain Local groups for assigning access in the resource domain.
Native-mode nesting rules | Active Directory security groups | AD DS group-type glossary
Native status interpretation
STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY is 0xC00002E5, an NTSTATUS error value. AllStat describes it as “A local group can only be a member of other local groups in the same domain.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Log the operation associated with ds / local / member / of / local, the object or handle type, process and thread identity, and the state transition immediately before the return.
- For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with this result.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “A local group can only be a member of other local groups in the same domain.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.