Fix ERROR_MEMBER_NOT_IN_GROUP (0X00000529) – Group Membership

This error hits when trying to remove a user from a group in Windows, but the user isn't actually a member. The fix is usually a group membership refresh or a schema check.

You're trying to remove a user from a local or Active Directory group in Windows, and you get slapped with ERROR_MEMBER_NOT_IN_GROUP (0X00000529). The exact message reads: "The specified user account is not a member of the specified group account." This usually happens in one of two real-world scenarios:

You're cleaning up a user's permissions after they've left the company, and the group membership list shows them still there, but the OS disagrees.
A script or admin tool (like net localgroup or dsmod group) fails when trying to remove a user who was added through a nested group or a stale SID.

Had a client last month whose entire print queue died because of this – a former employee's account was listed in the "Print Operators" group in ADUC, but the actual security principal was a SID that had been orphaned. Removing them threw this error every time.

Root Cause

Plain and simple: Windows is telling you the user object doesn't exist in the group's membership list at the moment you're trying the removal. This can happen for three reasons:

Stale SID: The user's account was deleted and recreated with a new SID, but the group still references the old SID.
Nested group membership: The user is in the group via another group (like Domain Users), not directly. You can't remove a member that's inherited.
Replication delay: In a domain environment, the group membership was updated on another DC, and your DC hasn't caught up yet.
Corrupted group object: Rare, but the group's membership attribute is corrupted.

Fix: Step-by-Step

Skip the GUI for now – we're going command-line because it's faster and shows you the real state.

Step 1: Verify the user is actually in the group

Open Command Prompt as Administrator. Run this to list all members of the group:

net localgroup "GroupName"

For domain groups, use this PowerShell cmdlet:

Get-ADGroupMember -Identity "GroupName" | Select-Object Name, ObjectClass

If the user doesn't appear in the output, but the GUI says they're there, you've found the mismatch. The GUI is showing cached data.

Step 2: Try the removal again with the exact name

Sometimes the issue is a typo in the SAM account name. Use the exact name from Step 1.

net localgroup "GroupName" "Username" /delete

Step 3: Force a group refresh (domain environments only)

If replication is the problem, force your local DC to pull changes:

repadmin /syncall

Then wait 30 seconds and retry.

Step 4: Check for nested groups

If the user is a member of a group that's in the group, you can't remove them directly. Use PowerShell to list effective members:

Get-ADGroupMember -Identity "GroupName" -Recursive | Select-Object Name

If the user appears as a nested member, remove them from the parent group first.

Step 5: Remove by SID (advanced)

If the user's account is deleted but the SID remains in the group, you need to remove the SID directly. First, find the SID:

Get-ADGroup "GroupName" -Properties Members | Select-Object -ExpandProperty Members

Look for a SID that starts with S-1-5-21-... that doesn't resolve to a username. Then remove it:

Remove-ADGroupMember -Identity "GroupName" -Members "S-1-5-21-123456789-123456789-123456789-1234" -Confirm:$false

Step 6: Repair corrupted group

If nothing works, the group membership attribute might be corrupted. Run this on the domain controller:

repadmin /showobjmeta dc=yourdomain,dc=com "CN=GroupName,CN=Users,DC=yourdomain,DC=com"

Look for errors in the member attribute. If it's corrupted, you'll need to restore the group from backup or recreate it.

Still failing? Check these

If the error persists after all that, here's what to check:

Group type: Are you trying to remove a user from a distribution group instead of a security group? Distribution groups don't support security operations.
Permissions: You need the right delegation. Domain admins or group owners only.
Firewall: In a cross-domain trust scenario, RPC ports must be open between DCs for group membership operations.
Last resort: Delete the group and recreate it. Export the membership list first, then add everyone back manually. It's ugly but works.

One more thing: if you're on a workgroup (no domain), this error almost never happens unless the SAM database is corrupted. In that case, back up the user profiles, nuke the local group, and rebuild it from scratch.