Fix ERROR_MEMBERS_PRIMARY_GROUP 0X0000055E in Active Directory

Quick Answer

Change the user's primary group to something else (usually Domain Users), then remove them from the group.

This error pops up in Active Directory when you try to delete a user from a group that's set as their primary group. Every domain user must belong to at least one group — the primary group. Windows normally sets this to Domain Users, but it can get changed. I've seen this most often after administrators manually move users between OUs or scripts that modify group membership bypass the normal checks. The error text is clear: "The user cannot be removed from a group because the group is currently the user's primary group." The fix is straightforward once you know where to look.

Step-by-Step Fix

1. Identify the group causing the error.
   When you get the error, note the group name. In Active Directory Users and Computers (ADUC), right-click the user and go to Member Of. The group with the error is the one you tried to remove them from.
2. Check the user's primary group.
   Open the user's properties, go to the Member Of tab. Look at the bottom — there's a section called Primary group. If it shows the same group, that's your problem.
3. Change the primary group to Domain Users.
   In the same Member Of tab, click Set primary group. A list of groups appears. Select Domain Users (or any group the user must stay in), then click OK. You'll see the primary group update immediately.
4. Remove the user from the original group.
   Now go back to the Member Of tab, select the group you couldn't remove earlier, and click Remove. This time it should work without error.
5. Verify the change.
   Open a command prompt on a domain controller and run:
   

   net user username /domain | find /i "primary group"

   Replace username with the actual username. You should see Domain Users (or whatever you set) listed.

Alternative Fixes (If the Main One Fails)

Use ADSI Edit

If ADUC won't let you change the primary group (uncommon but possible), use ADSI Edit:

1. Install ADSI Edit from Server Manager > Tools > ADSI Edit.
2. Connect to the domain's Default Naming Context.
3. Find the user under their OU.
4. Right-click the user, choose Properties.
5. Find the attribute primaryGroupID and double-click it.
6. Change the value to 513 (the RID for Domain Users). Click OK.
7. Now you can remove the user from the group in ADUC.

Use Command Line (dsmove or net user)

You can also fix this with commands. On a domain controller, run:

net user username /primarygroup:"Domain Users" /domain

After it completes, try the removal again.

Prevention Tips

• Never set a non-default group as primary unless you really know what you're doing. Domain Users is the safe default for 99% of users.
• When moving users between OUs, use ADUC's Move feature rather than cutting and pasting in ADSI Edit. The Move wizard preserves primary group settings.
• Audit your groups regularly — run a PowerShell script that lists users whose primary group isn't Domain Users:

Get-ADUser -Filter * -Properties PrimaryGroup | Where-Object { $_.PrimaryGroup -ne "CN=Domain Users,CN=Users,DC=yourdomain,DC=com" }

This catches the problem before it causes errors.

Why This Matters

Primary groups are a legacy from old Windows NT domains, where users could belong to only one group. Modern AD supports multiple groups, but the primary group attribute still exists and bits of the OS (like the logon process) rely on it. If you break it, you might see issues with network access or file permissions. The error 0x0000055E is your warning — fix it before those problems show up.