JSI Tip 8173. When you attempt to add a built-in group to a domain local group in Windows Server 2003, you receive 'A new member could not be added'?

When you attempt to add a built-in group to a domain local group using Active Directory Users and Computers, you receive:

The following Active Directory error occurred: A new member could not be added to a local group because the member has the wrong account type.

When you attempt the Windows 2000 workaround:

net localgroup "" "NT AuthorityAuthenticated Users" /ADD

you receive:

System error 1388 has occurred. A new member could not be added to a local group because the member has the wrong account type.

When you attempt to see if enumerating error 1388 provides additional information, typing net helpmsg 1388, returns:

A new member could not be added to a local group because the member has the wrong account type.

In Windows Server 2003, domain local groups can contain any security principal except a built-in group.

NOTE: See Windows 2000 group types and scope usage.

NOTE: For Windows 2000 Server, see How to Add Special Groups to Built-In Groups.