What does Windows error code 8493 (ERROR_DS_CANT_WITH_ACCT_GROUP_MEMBERSHPS) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: An object with account-group memberships cannot be moved across domain boundaries.

Previous	Next
ERROR_DS_ILLEGAL_XDOM_MOVE_OPERATION	ERROR_DS_NC_MUST_HAVE_NC_PARENT

ERROR_DS_CANT_WITH_ACCT_GROUP_MEMBERSHPS

ERROR_DS_CANT_WITH_ACCT_GROUP_MEMBERSHPS (8493) is an Active Directory Domain Services error. The object is a member of account groups whose membership rules would be invalid after a cross-domain move. The directory blocks the move to prevent silently creating unsupported group relationships.

What to check

Export and review the object group memberships before making changes.
Remove or redesign only the memberships that make the cross-domain move invalid; keep an audit record so required access can be recreated safely.
Ensure the source and target servers meet the cross-domain Move-ADObject requirements.

Useful command

Get-ADPrincipalGroupMembership -Identity "<Object>"

Microsoft: Move-ADObject · Microsoft: Understand Active Directory security groups · Microsoft: Directory Service system error codes

Looking for a different code? Search another status or error code.