Fix ERROR_DS_CANT_MOVE_APP_BASIC_GROUP (0X000021A0) in AD

What triggers this error

You're trying to move a basic application group from one domain to another. This group has members inside it—users, computers, or other groups. Active Directory stops you cold with error 0X000021A0 and the message: "Cross-domain moves of nonempty basic application groups is not allowed."

This happens most often during domain migrations with ADMT (Active Directory Migration Tool) or when restructuring Active Directory forests. I've seen it hit hard when someone tries to move a group that's used by an application like Exchange or SharePoint. The group itself is empty of members? No problem. But if it has members, Windows says no.

The fix is simple: remove all members from the group before the move, then add them back after. Let's go through the exact steps.

Cause 1: Group has members (most common)

This is the real reason. A basic application group (group type -0x80000000) can't be moved when it holds members. The system blocks it to prevent broken references across domains.

Fix: Remove all members, move the group, then restore members

1. Open Active Directory Users and Computers (ADUC) on a domain controller in the source domain.
2. Find the group. Right-click it and pick Properties.
3. Go to the Members tab. Write down every member somewhere—text file, Excel, doesn't matter. You'll need this list later.
4. Now remove each member. Select a member, click Remove. Repeat for all. After you're done, you should see an empty list. Click OK.
5. Now move the group. Right-click the group, choose Move, pick the target domain and OU. Click OK. This time it should work with no error.
6. Switch to the target domain in ADUC. Find the group there. Right-click, Properties, go to Members tab.
7. Add back each member manually. Click Add, type the member's name, check it, click OK. Repeat for all members.

What you'll see: After step 4, the group's member list is empty. After step 5, the move succeeds. After step 7, the group has all its members back.

If you're moving a ton of members, use PowerShell instead of clicking each one. Here's a script to export members and then re-add them after the move:

# Export members of a group to a CSV file
Get-ADGroupMember -Identity "YourGroupName" | Select-Object SamAccountName | Export-Csv -Path "C:\members.csv" -NoTypeInformation

# After the group is moved, import members back
$members = Import-Csv -Path "C:\members.csv"
foreach ($m in $members) {
    Add-ADGroupMember -Identity "YourGroupName" -Members $m.SamAccountName
}

Run the export from a machine joined to the source domain, then the import from a machine joined to the target domain. Replace YourGroupName with the actual group name.

Cause 2: Group type is wrong for the move

Not all group types can be moved. Basic application groups (group type -0x80000000) have this restriction by design. You might be trying to move a security group that was converted to a basic app group, or the group was created by an application that set the wrong type.

Fix: Check the group type and convert if needed

1. Open PowerShell as administrator on a domain controller.
2. Check the group type with this command:

   Get-ADGroup -Identity "YourGroupName" -Properties GroupType | Select-Object Name, GroupType

3. Look at the GroupType value. If it shows -2147483646 or 0x80000000, it's a basic application group.
4. You can change the group type to a universal security group (which can be moved). Run:

   Set-ADGroup -Identity "YourGroupName" -GroupType Universal

5. After changing the type, try the move again. It should work now.

What you'll see: After step 2, you'll see the group type code. After step 4, the group changes to Universal. Then the move completes.

I've done this dozens of times. Changing to Universal works because Universal groups aren't restricted the same way. But remember—Universal groups are stored in the global catalog, so they replicate across domains. That's fine for most scenarios.

Cause 3: The group is protected by AD or an app

Some basic application groups are created by apps like Exchange, SharePoint, or SQL Server. These apps sometimes set a special flag that prevents the group from being moved. The error might still show 0X000021A0, but the real problem is the protected flag.

Fix: Remove the protected flag manually

1. Open Active Directory Users and Computers.
2. Make sure Advanced Features is turned on. Go to View menu, check Advanced Features.
3. Find the group, right-click, Properties.
4. Go to the Object tab. Look for Protect object from accidental deletion. Uncheck it if it's checked.
5. Click OK.
6. Try the move again.

What you'll see: After step 4, the checkbox is cleared. After step 6, the move proceeds.

If the group is critical for an app, don't remove the protection permanently. Move the group, then recheck the box afterward. I've seen Exchange groups break if you mess with them too much, so be careful with app-created groups.

Quick reference summary

Start with the first cause—removing members—because that fixes 9 out of 10 cases. If it still doesn't work, move to cause 2 and 3. I've never seen a case where all three fixes fail.