What does NTSTATUS 0xC0000406 (STATUS_DS_GROUP_CONVERSION_ERROR) mean?

STATUS_DS_GROUP_CONVERSION_ERROR

Meaning and context of STATUS_DS_GROUP_CONVERSION_ERROR

This is a conversion-specific failure, not an assertion that the group is missing or that its members are generally invalid. Active Directory validates the current member list and the groups that contain the target before it allows a scope transition.

Inspect both directions of nesting: the group’s members and its parent groups. For example, a Global group can become Universal only when it is not a member of another Global group; a Domain Local group can become Universal only when it has no Domain Local member and no Foreign Security Principal member from another forest.

Plan the conversion as an access-control change. Scope and type influence token use and whether a security group SID is meaningful in ACLs. Remove or redesign only the relationship that violates the requested transition, then re-evaluate the effective access path before committing the change.

Group scope conversion rules | Active Directory security groups | Foreign Security Principals container

Native status interpretation

STATUS_DS_GROUP_CONVERSION_ERROR is 0xC0000406, an NTSTATUS error value. AllStat describes it as “The group cannot be converted due to attribute restrictions on the requested group type.”