| Previous | Next |
| STATUS_DS_LOCAL_MEMBER_OF_LOCAL_ONLY | STATUS_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED |
STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS
Meaning and context of STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS
A Foreign Security Principal (FSP) is an Active Directory object that represents a principal from a trusted domain outside the forest. AD DS can use an FSP for group membership within the domain, but Universal group membership is limited to accounts, Global groups, and Universal groups from the same forest.
Inspect the candidate object class and its source domain or forest. A resolved display name is not enough: an object under the ForeignSecurityPrincipals container can represent a valid external identity while still being an invalid member for a Universal group.
Use an allowed resource-facing group design, usually a Domain Local group in the domain that owns the resource, when external-trust principals must receive access. Do not delete FSP objects as a first response; they are directory representations of trust-backed principals, not arbitrary duplicates.
Foreign Security Principals container | Active Directory security groups | NTSTATUS reference
Native status interpretation
STATUS_DS_NO_FPO_IN_UNIVERSAL_GROUPS is 0xC00002E6, an NTSTATUS error value. AllStat describes it as “Foreign security principals cannot be members of universal groups.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Correlate this result with ETW, Event Viewer, protocol traces, or a dump from the component that owns ds / fpo / in / universal / groups; do not diagnose from translated text alone.
- For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with this result.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “Foreign security principals cannot be members of universal groups.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.