Active Directory error 0x0000208A – parent alias not allowed

When you see this error

You're in Active Directory Users and Computers (ADUC) or using PowerShell to move a security group from one OU to another. Or you're renaming a group. Right when you hit Apply, you get a popup: "The parent is an alias. Having a parent that is an alias is not permitted." The exact error code is 0x0000208A.

This usually happens in organizations that mix security groups with mail-enabled groups—common when you use Exchange on-prem or have synced groups from Office 365. You'll see it when a group you're moving sits directly under another group that's an alias (a mail-enabled group with no security membership).

What's actually going on

Active Directory has two core group types: security groups and distribution groups (alias groups). Security groups can have members and can be nested under other security groups. Alias groups (mail-enabled distribution groups) can't act as parents for security groups in a move or rename operation. The error is Windows Directory Service enforcing that rule.

The root cause is almost always a mistaken group hierarchy. Someone at some point dragged a security group into a distribution group's OU or linked it via a parent-child relationship that the system won't allow. It's not a corruption—it's a design violation.

How to fix it

You have two paths. Path A changes the parent group from alias to security group (if you need it to be a parent). Path B removes the invalid parent relationship. I'll give you both below.

Before you start

You'll need Domain Admin rights or delegated permissions to modify group attributes. And make sure you have a recent backup of the affected groups—export them with PowerShell first.

Get-ADGroup -Identity "OffendingGroupName" -Properties * | Export-Clixml C:\backup\group_backup.xml

Path A: Convert the alias group to a security group

This works if you want the parent group to stay as a parent and you need it to keep mail features.

1. Open ADUC. Go to View and check Advanced Features.
2. Find the parent group (the one that's an alias). Right-click it, choose Properties.
3. Go to the Object tab.
4. Uncheck the box: Group type: Distribution. Then check Security.
5. Click Apply. You'll get a warning that this changes the group type—click Yes.
6. After you do this, the group becomes a security group. Now retry the move or rename of the child group. It should work.

Important: Converting a distribution group to security group enables it for security permissions. If this group was used only for mail distribution, adding ACLs might break your mail flow. Test on a non-production group first.

Path B: Remove the alias parent relationship

Use this if you don't need the group to be a parent, or you want to move the child group to a clean OU.

1. Open ADSI Edit. If you don't have it installed, add the AD DS and AD LDS Tools feature via Server Manager.
2. Connect to the Default Naming Context.
3. Navigate to the child group's DN. Example: CN=ChildGroup,OU=Groups,DC=domain,DC=com.
4. Right-click the child group, choose Properties.
5. Scroll down to find the attribute parent or managedBy (sometimes the alias relationship is set via managedBy). If you see a value that points to the alias group, delete that value.
6. Click OK.
7. Now move the child group to a different OU (like a standard "Security Groups" OU) using ADUC. This time it should work.

What to check if it still fails

If neither path works, you might have a deeper issue. Here's what to look at next:

• Group nesting limits. AD allows up to 1000 nested groups. If the parent group is itself nested under another alias, you'll need to resolve the entire chain. Use PowerShell to check: Get-ADGroupMember -Identity "ParentGroup" -Recursive | Measure-Object.
• Exchange attributes. The alias group might have Exchange attributes (like mail) that tie it to a recipient policy. In that case, converting it to a security group could orphan those settings. Use the Exchange Admin Center to unlink the mail settings first, then convert.
• Permission inheritance. If the child group inherits permissions from the alias group's OU, moving it might break access. Check the OU's ACLs and consider moving the group to a new OU with explicit permissions.
• Last resort: Delete the child group and recreate it in the target OU. Re-add members manually or via script. This is ugly, but it works when the group's metadata is corrupted.

One more thing: if you're using a hybrid Exchange/Office 365 setup, the alias group might actually be a cloud-managed object. In that case, don't try to fix it on-prem—use the Exchange admin center or Azure AD Connect to adjust group membership.