Security Compliance

Error: Group cannot be changed. It is a primary group of a member.

This article explains how to mitigate a problem with changing a group membership in ARM.

First published date

9/16/2021 7:54 AM

Last published date

7/7/2022 3:40 PM

Overview

  • It can happen that for some reason the Primary Group of a user is changed in AD. By default, the Domain Users group is set as a primary group for a user.

Product section

Access Rights Manager

Cause

  • The change of the group membership cannot be performed because it can be that that group is set as a primary group for that user.
  • To be able to successfully change the Primary Group ID, the user must be a member first of that group.

Resolution

There can be different solutions in this case.
  1. Change the primary group in ARM and try to perform the group membership again. To be able to edit the primary group in ARM please add the respective missing code in the pnServer.config.xml file, save the file and restart the ARM-Service on the ARM Server. 
    <changeConfiguration>
    <activeDirectory>
       <PropertiesToLoad type="System.String">primaryGroupID</PropertiesToLoad>
       <PropertiesDetails>
             <primaryGroupID>    
                   <IsChangeable type="System.String">true</IsChangeable>         
                   <IsInitialConfigurable type="System.String">true</IsInitialConfigurable>        
             </primaryGroupID>    
       </PropertiesDetails>
   </activeDirectory>
</changeConfiguration>

    The value of the primaryGroupID attribute is the RID number at the end of the group's SID. For example for the Domain Users group, it should be '513'
  2. Change the primary group directly in AD from Domain Users and Computers interface for the related user.
  3. Execute the following PowerShell command: 
    # Scripts are not supported under any SolarWinds support program or service.
# Scripts are provided AS IS without warranty of any kind. SolarWinds further
# disclaims all warranties including, without limitation, any implied warranties
# of merchantability or of fitness for a particular purpose. The risk arising
# out of the use or performance of the scripts and documentation stays with you.
# In no event shall SolarWinds or anyone else involved in the creation,
# production, or delivery of the scripts be liable for any damages whatsoever
# (including, without limitation, damages for loss of business profits, business
# interruption, loss of business information, or other pecuniary loss) arising
# out of the use of or inability to use the scripts or documentation.

Set-aduser -identity ABCDEF123456789 -Replace @{PrimaryGroupID="1728"}

    where ABCD... is the user and 1728 is the RID of the planned group. RID - Reduced Identifier (the number behind the last hyphen in the SID)