What's going on with this error?
You're trying to change a group from security-enabled to security-disabled, and Windows hits you with 0XC00002DC. The message says "Cannot change to a security-disabled group because primary members are in this group." This usually happens in Active Directory when you have a group that's used as the primary group for users or computers. I know this error is infuriating — it stopped me cold the first time I saw it on a Windows Server 2019 box.
The real fix is simple: you need to remove the primary members from the group, change its type, then add them back. But there's a trick — you can't always see who those primary members are in the normal GUI. Let me walk you through it.
Simple fix: Check and remove primary members (30 seconds)
First, check if the group has any users or computers set with it as their primary group. Open Active Directory Users and Computers on your domain controller. Right-click the group and pick Properties. Go to the Members tab. If you see any members listed, they might be primary members — but the GUI doesn't tell you which ones.
Here's the fast workaround: if the group has any members, remove them all temporarily. Select each member and click Remove. Then try changing the group type again. Go to the General tab, find Group type, switch from Security to Distribution, and click OK. If it works, add the members back after. This takes about 30 seconds if you know the group has members.
But what if the group shows no members in the GUI and you still get the error? That's the tricky part — keep reading.
Moderate fix: Find hidden primary members with PowerShell (5 minutes)
The GUI sometimes hides primary group assignments, especially for computer objects or old accounts. The real tool here is PowerShell. Open it as Administrator on a domain controller or a machine with RSAT tools installed.
Run this command to find every object that has your group set as its primary group. Replace YourGroupName with the actual group name:
Get-ADObject -Filter 'PrimaryGroup -eq "CN=YourGroupName,OU=Groups,DC=yourdomain,DC=com"' -Properties PrimaryGroupIf you don't know the full distinguished name, use this to find it first:
Get-ADGroup -Filter 'Name -eq "YourGroupName"' | Select-Object DistinguishedNameThen plug that in. The result will show you the SamAccountName of each object that has this group as primary. Look for users and computers. For each one, you need to change their primary group. For a user, run:
Set-ADUser -Identity "username" -PrimaryGroup "Domain Users"For a computer, run:
Set-ADComputer -Identity "computername" -PrimaryGroup "Domain Computers"After changing all of them, try the group type change again. This approach works every time — I've used it on Server 2016 and 2022 domains.
Advanced fix: Use ADSI Edit to force the change (15+ minutes)
If PowerShell still gives you the error, you might have orphaned references or replication issues. This is where ADSI Edit comes in. It's dangerous — you can break things — but it's the nuclear option.
- Open ADSI Edit from Administrative Tools. If it's not there, install it via Server Manager under Remote Server Administration Tools > AD DS and AD LDS Tools.
- Right-click ADSI Edit and choose Connect to. Under Select a well known Naming Context, pick Default naming context. Click OK.
- Navigate down to the group's distinguished name. For example:
CN=YourGroupName,OU=Groups,DC=yourdomain,DC=com. - Right-click the group and choose Properties.
- Find the attribute groupType. Its value tells you the current type. For a security group, it's usually
-2147483646(global) or similar. To make it a distribution group, change the value to a positive number. For a global distribution group, set it to2. For universal,8. Here's a quick reference:
| Group type | groupType value |
|---|---|
| Global distribution | 2 |
| Universal distribution | 8 |
| Local distribution | 4 |
- Set the groupType attribute to the distribution value. Click Set, then OK.
- Close ADSI Edit. The group should now be security-disabled.
I only recommend this if you're comfortable with AD internals. It bypasses the safety checks that cause the 0XC00002DC error. After this, verify in Active Directory Users and Computers that the group shows as Distribution. Then add your members back.
When this error shows up
I've seen this most often when IT admins try to convert a security group to a distribution group for emailing purposes, but a user's primary group is still pointing to it. It also happens after migrating from Exchange 2010 to modern setups where group types get mixed up. The error's rare — you might only see it once a year — but when it hits, it's a real head-scratcher.
One last tip: if you're doing this on a large domain with many members, use PowerShell to script the primary group changes. It's way faster than clicking through the GUI for 50 users. And always test on a small group first. Good luck.