| Previous | Next |
| STATUS_PRENT4_MACHINE_ACCOUNT | STATUS_INVALID_IMAGE_WIN_32 |
STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER
Meaning and context of STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER
An account group is the directory terminology for a Global group. This status therefore expresses the same scope direction as the Global-group rule: a Global group cannot contain a Universal group, even though the Universal group may contain Global groups from domains in the forest.
Confirm the actual groupType of both objects before changing the request. Names such as “global” or “enterprise” in a group label do not establish the AD scope; the directory attributes do.
Reverse the nesting direction when the goal is to aggregate domain-specific Global groups for forest-wide use, or select a Domain Local group for resource assignment. Do not change scope without reviewing existing members and parent memberships because Global-to-Universal conversion has documented prerequisites.
AD DS group-type glossary | Active Directory security groups | Group scope conversion rules
Native status interpretation
STATUS_DS_AG_CANT_HAVE_UNIVERSAL_MEMBER is 0xC0000358, an NTSTATUS error value. AllStat describes it as “A account group cannot have a universal group as a member.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Correlate this result with ETW, Event Viewer, protocol traces, or a dump from the component that owns ds / ag / cant / have / universal; do not diagnose from translated text alone.
- For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with this result.
Recovery considerations
A retry is appropriate only after the owner of this result has changed the state described by “A account group cannot have a universal group as a member.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.