What does NTSTATUS 0xC00002E6 (STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS) mean?

STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS

Meaning and context of STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS

A Foreign Security Principal (FSP) is an Active Directory object that represents a principal from a trusted domain outside the forest. AD DS can use an FSP for group membership within the domain, but Universal group membership is limited to accounts, Global groups, and Universal groups from the same forest.

Inspect the candidate object class and its source domain or forest. A resolved display name is not enough: an object under the ForeignSecurityPrincipals container can represent a valid external identity while still being an invalid member for a Universal group.

Use an allowed resource-facing group design, usually a Domain Local group in the domain that owns the resource, when external-trust principals must receive access. Do not delete FSP objects as a first response; they are directory representations of trust-backed principals, not arbitrary duplicates.

Foreign Security Principals container | Active Directory security groups | NTSTATUS reference

Native status interpretation

STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS is 0xC00002E6, an NTSTATUS error value. AllStat describes it as “Foreign security principals cannot be members of universal groups.”