What does Windows error code 8498 (ERROR_DS_CANT_MOVE_ACCOUNT_GROUP) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A non-empty account group cannot be moved across domain boundaries.

Previous	Next
ERROR_DS_MISSING_INFRASTRUCTURE_CONTAINER	ERROR_DS_CANT_MOVE_RESOURCE_GROUP

ERROR_DS_CANT_MOVE_ACCOUNT_GROUP

ERROR_DS_CANT_MOVE_ACCOUNT_GROUP (8498) is an Active Directory Domain Services error. The directory service rejected a cross-domain move of a non-empty account group. Group scope and membership semantics are domain-dependent, so the group must be redesigned or migrated rather than directly moved intact.

What to check

Inventory group scope, members, nested groups, ACL usage, and application dependencies.
Create an appropriate destination group and migrate membership and permissions under a controlled plan.
Do not remove memberships blindly; record and validate access after the migration.

Useful command

Get-ADGroupMember -Identity "<Group>" -Recursive

Microsoft: Understand Active Directory security groups · Microsoft: Move-ADObject · Microsoft: Directory Service system error codes

Looking for a different code? Search another status or error code.