Active Directory Group Conversion Error 0x0000219F Fix

You're trying to convert a security group to a distribution group (or the other way) in Active Directory Users and Computers, and you get the error: ERROR_DS_GROUP_CONVERSION_ERROR (0X0000219F). I've seen this most often when someone promotes a new domain controller from an existing member server, or when they try to change a group that's nested inside another group. The error message says "The group conversion failed because the group is in a domain with a different domain functional level" — but that's rarely the real reason.

The actual culprit is a mismatch between the group's scope (domain local, global, or universal) and the target type. Windows won't let you convert a group if doing so would break its membership rules. For example, a domain local group can't be converted to a global group if it contains a global group from another domain. And a universal group can't be converted to a domain local group if it's already a member of another universal group. The system checks these constraints and throws that error instead of letting you create a broken structure.

Here's the fix. I'll walk you through the most common scenario, then give you a fallback using ADSI Edit.

Fix 1: Check and Adjust Group Scope First

1. Open Active Directory Users and Computers (dsa.msc).
2. Find the group that's failing. Right-click it and select Properties.
3. Go to the General tab. Look at the Group type and Group scope radio buttons.
4. Write down the current scope. If the scope is Domain Local, change it to Global first, then apply. If it's already Global, try Universal.
5. Click Apply. After applying, you should see the scope change take effect without error. If it errors here, don't force it — that's your sign the membership rules block it.
6. Once the scope is changed, go back to Group type and make the conversion you originally wanted. Click OK.

I've fixed this error dozens of times this way. The trick is to convert the scope to Universal first. Universal groups can hold anything, so the conversion to a different type usually sails through after that.

Fix 2: Remove Nested Memberships

If the scope change fails, it means the group is nested inside another group that's blocking it. You'll need to remove the group from any parent groups temporarily.

1. In the group's Properties, go to the Member Of tab.
2. You'll see a list of groups this group belongs to. For each one, open its properties and remove this group from its Members list.
3. After removing all parent group memberships, try the scope change again.
4. Once the conversion succeeds, re-add the group to those parent groups.

This is a pain if the group is nested in multiple places, but it's the only safe way. I've seen techs try to force it with ADSI Edit and end up with a corrupt group — don't do that.

Fix 3: Use ADSI Edit to Bypass (Only If You Must)

Sometimes the error shows up during domain controller promotion, not from a manual change. In that case, you can't open ADUC on the new DC yet. You'll need to edit the group attribute directly on the existing DC.

1. Log on to any domain controller as a domain admin.
2. Run adsiedit.msc.
3. Right-click ADSI Edit in the left pane and select Connect to. Choose Default Naming Context and click OK.
4. Expand the domain, then CN=Users (or whatever OU holds the group). Find the problematic group.
5. Right-click the group and select Properties.
6. Find the attribute groupType. It's a number. Open it and change the value. Here's a cheat sheet:

For example, if you need a universal security group, set groupType to 2147483651. Click Set, then OK.

This works, but I don't recommend it unless you're stuck. ADSI Edit doesn't check membership rules — you could corrupt a group if you set a combination that's invalid. Always back up the group's current value before you change it.

What to Check If It Still Fails

If you've tried all three fixes and still get 0x0000219F, there are two things left to check.

First, check the domain functional level. Open Active Directory Domains and Trusts, right-click the domain, and select Raise Domain Functional Level. If it's set to Windows Server 2003 or lower, you can't have universal groups with certain conversions. Raise it to at least Windows Server 2008. That solves the error about half the time when nothing else works.

Second, check for lingering objects. Run repadmin /removelingeringobjects on each DC against the failing group's DN. Lingering objects from a failed replication can block group type changes. I've seen a single lingering object cause this error on a DC promotion.

If none of that helps, you're looking at a deeper AD health issue. Run dcdiag /v on all DCs and look for replication or DNS failures. That error code doesn't lie — something's out of sync.