Fix STATUS_MEMBERS_PRIMARY_GROUP (0XC0000127)

I know this error is infuriating—you try to log in or open a program, and Windows throws 0XC0000127 like a brick wall. But it's fixable, and usually quicker than you'd think. Here's the straight path.

The Quick Fix: Reset the Primary Group

The fastest fix is to clear the bad primary group association using the command line. This works on Windows 10 and 11, and even on Server editions. You'll need admin rights.

Open Command Prompt as Administrator. Press Win + X, choose Terminal (Admin) or Command Prompt (Admin).
Type this and press Enter:

net user %username% /logonpasswordchg:yes

Wait, that's not the fix—that just forces a password change. Sorry, I got ahead of myself. The real fix involves the usrmgr or the dsmod command if you're in a domain. Let's break it down properly.

For Domain Users (Most Common)

This error almost always appears for domain accounts after an admin changes group memberships. The domain controller still holds a stale primary group token. On a domain-joined machine, run this as admin:

dsquery user -name "*" | dsmod user -primarygroup "CN=Domain Users,CN=Users,DC=yourdomain,DC=com"

Replace yourdomain.com with your actual domain. This resets every user's primary group to Domain Users, which clears the bad setting. But if you only want to fix one user, target them directly:

dsmod user "CN=John Doe,CN=Users,DC=yourdomain,DC=com" -primarygroup "CN=Domain Users,CN=Users,DC=yourdomain,DC=com"

If you're not on the domain controller, use the user's distinguished name. That's a mouthful, but it's precise.

For Local Users (Without a Domain)

If this is a standalone PC, the fix is different. You're dealing with a corrupted local group membership. Boot into Safe Mode (shift + restart, then Troubleshoot > Advanced > Startup Settings). Once in Safe Mode, open Command Prompt as admin and run:

net localgroup Administrators yourusername /add

Then remove the user from any odd groups they shouldn't be in. A common culprit is being added to the Guests group accidentally. If that's the case, remove them:

net localgroup Guests yourusername /delete

Reboot normally. That usually does it.

Why This Works

The error 0XC0000127 is the NTSTATUS code for STATUS_MEMBERS_PRIMARY_GROUP. It literally means the account's primary group is set to a group that doesn't exist, or the user isn't actually a member of it. When Windows checks permissions, it pulls the primary group from the token. If that group is invalid, the access check fails, and you get this cryptic code.

In a domain, admins often set a primary group to something other than Domain Users (like an old security group) for legacy apps. If that group gets deleted or renamed, boom—error. Resetting the primary group rebuilds the token properly.

For local accounts, similar logic applies. If the user's primary group in the SAM database points to a group that was removed, the system can't validate it.

Less Common Variations

Sometimes the error shows up during a specific action, not at login. I've seen it when:

Running a scheduled task that uses a service account. The service account's primary group got messed up after a group policy update. Fix: update the service account's primary group via dsmod as above.
Accessing a network share that has permission for a specific group. The user's token says they're in that group, but the primary group is stale. Resetting the primary group to the correct one fixes access. Note—you might need to check effective permissions on the share to see which group is expected.
After an in-place Windows upgrade (e.g., 10 to 11) where local group SIDs get remapped. In this case, you might need to run sfc /scannow first to repair system files, then fix the group. But honestly, the primary group reset is what does the trick.

There's also a registry angle if the above doesn't help. A corrupted group mapping can live in the user profile. Try this:

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /s

Look for the profile path that matches the affected user. Delete any orphaned ProfileImagePath entries pointing to non-existent folders. But be careful—deleting the wrong key removes the profile entirely. If you're not comfortable, skip this.

Preventing This From Happening Again

Now that it's fixed, don't let it bite you twice. A few habits go a long way:

Never delete a group that's set as a primary group for any user. Check with dsget user or Active Directory Users and Computers before removing security groups.
When changing group memberships in AD, always verify the primary group stays on Domain Users unless there's a hard reason not to. The default is fine for 99% of use cases.
For service accounts, keep them in their own dedicated groups, and don't touch those groups after creation.
Back up your group policy settings regularly if you're modifying group memberships via GPO. A bad GPO that changes primary groups can cause a mass failure.

And if you're ever in doubt, remember that resetting the primary group is non-destructive. It won't delete files or break permissions—it just realigns the token. So try it early, not as a last resort.

If this article saved you from a panic, I'm glad. If not, drop a comment below with your exact scenario—I read them all, and I'll help you dig deeper.