| Previous | Next |
| ERROR_INVALID_USER_PRINCIPAL_NAME | ERROR_DS_OID_NOT_FOUND |
ERROR_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS
OID mapped groups cannot have members.
ERROR_DS_OID_MAPPED_GROUP_CANT_HAVE_MEMBERS is Win32 error 8637 (0x000021BD) in Active Directory Domain Services.
Likely impact: Adding membership would change the meaning of an object reserved for identifier mapping.
Typical causes
- automation treats every group class as membership-capable.
- a schema or authorization mapping object is mistaken for a security group.
- the target DN is wrong.
- migration copies member attributes indiscriminately.
Troubleshooting steps
- Verify that the object is used only for its OID mapping and is not modified with member values.
- Collect group DN and object class and OID mapping attributes.
Useful evidence
- Collect schema definition.
- Collect provisioning rule that selected the object.
Recovery and retry
Target a normal security or distribution group for membership and leave the OID-mapped object without members.
Related errors
ERROR_DS_ATTRIBUTE_OR_VALUE_EXISTS concerns duplicate attribute values; this code prohibits member values by object semantics
Example
A generic group sync selects an OID-mapped group by name and tries to add users. Filtering by object class routes members to the intended security group.
References
Looking for a different code? Search another status or error code.