0X0000056C ERROR_INVALID_MEMBER Fix: Group Membership Mess

Cause #1: Corrupt User or Group SID

This error almost always means Windows can't read the security identifier (SID) for the user or group you're trying to add. I've seen this happen after a user account gets deleted then recreated, or when you restore a system state backup. The SID in Active Directory or the local SAM doesn't match what Windows expects.

How to Check and Fix

1. Open Command Prompt as Administrator.
2. Run whoami /user for the current user, or wmic useraccount get name,sid to list all users and their SIDs.
3. Look for a SID that ends with -500 (local admin), -501 (guest), or a domain SID that looks wrong.
4. If the SID is missing or corrupt, delete the user/group from the local SAM using net user username /delete or net localgroup groupname /delete, then recreate it.

Had a client last month where their domain controller cached a bad SID from a previous migration. The error popped every time they tried to add a user to the "Domain Admins" group. Deleting the user from the local SAM and letting AD replicate fixed it instantly.

Cause #2: Group Policy Blocking Membership Changes

Some group policies restrict who can add members to certain groups. I've seen this mostly in domain environments where "Restricted Groups" policies are set. The error comes up as a permissions issue, not always with the exact 0X0000056C code, but close enough.

How to Diagnose and Fix

1. Open Group Policy Management Console.
2. Check the GPO linked to the OU where the computer or user lives.
3. Look under Computer Configuration > Security Settings > Restricted Groups.
4. If the group you're modifying is listed there, remove it or add the user to the policy's membership list instead.

Also check User Rights Assignment policies—sometimes "Add workstations to domain" is disabled and causes this error in domain join scenarios.

Cause #3: Local Group Database Corruption

If the SID issue isn't the problem and group policy isn't blocking it, the local SAM database might be corrupt. This happens on Windows 10/11 after a failed update or a virus cleanup. I've seen this specifically on systems where someone ran a third-party security tool that messed with user accounts.

Fix: Rebuild the Local SAM

1. Boot into Safe Mode with Command Prompt.
2. Run sfc /scannow to check system files.
3. If that doesn't help, run dism /online /cleanup-image /restorehealth.
4. Backup any important user data, then run net user administrator /active:yes to enable the hidden admin account.
5. Delete the problematic user with net user username /delete, then recreate it. This forces Windows to generate a fresh SID.

If the corruption is deep, you might need to do a repair install using the Windows setup media. Choose "Keep personal files and apps" to avoid losing data.

Quick-Reference Summary

Most of the time, it's the SID. Don't waste time on fancy tools—just delete and recreate the account. That fixes 9 out of 10 cases right there.