| Previous | Next |
| STATUS_DS_DUPLICATE_ID_FOUND | STATUS_VOLSNAP_PREPARE_HIBERNATE |
STATUS_DS_GROUP_CONVERSION_ERROR
Meaning and context of STATUS_DS_GROUP_CONVERSION_ERROR
This is a conversion-specific failure, not an assertion that the group is missing or that its members are generally invalid. Active Directory validates the current member list and the groups that contain the target before it allows a scope transition.
Inspect both directions of nesting: the group’s members and its parent groups. For example, a Global group can become Universal only when it is not a member of another Global group; a Domain Local group can become Universal only when it has no Domain Local member and no Foreign Security Principal member from another forest.
Plan the conversion as an access-control change. Scope and type influence token use and whether a security group SID is meaningful in ACLs. Remove or redesign only the relationship that violates the requested transition, then re-evaluate the effective access path before committing the change.
Group scope conversion rules | Active Directory security groups | Foreign Security Principals container
Native status interpretation for STATUS_DS_GROUP_CONVERSION_ERROR
STATUS_DS_GROUP_CONVERSION_ERROR is 0xC0000406, an NTSTATUS error value. AllStat describes it as “The group cannot be converted due to attribute restrictions on the requested group type.”. For STATUS_DS_GROUP_CONVERSION_ERROR, the first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.
Debugging sequence for STATUS_DS_GROUP_CONVERSION_ERROR
- Preserve STATUS_DS_GROUP_CONVERSION_ERROR before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Log the operation associated with ds / group / conversion, the object or handle type, process and thread identity, and the state transition immediately before the return.
- For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with STATUS_DS_GROUP_CONVERSION_ERROR.
Recovery considerations for STATUS_DS_GROUP_CONVERSION_ERROR
A retry is appropriate only after the owner of STATUS_DS_GROUP_CONVERSION_ERROR has changed the state described by “The group cannot be converted due to attribute restrictions on the requested group type.”, or when its contract explicitly marks the status as transient. For STATUS_DS_GROUP_CONVERSION_ERROR, if the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Looking for a different code? Search another status or error code.