Fix 0XC002003A: No More Members in Active Directory

The Short Fix

You're seeing 0XC002003A when trying to add members to a group in Active Directory Users and Computers. I've seen this on Windows Server 2016 and 2019 mostly. The real fix is usually the group's scope or a stale membership cache.

1. Open ADSI Edit – go to Start > Run, type adsiedit.msc, hit Enter. If you don't have it, install RSAT tools first.
2. Connect to the right domain – right-click ADSI Edit, choose "Connect to". Select "Default naming context" and OK.
3. Find the problematic group – expand the domain, then CN=Users (or CN=Groups if it's a custom OU). Look for the group name.
4. Check the groupType attribute – right-click the group, choose Properties. Find groupType in the list. Double-click it. The value tells you the scope:
   • -2147483646 = Global Security group
   • -2147483644 = Domain Local Security group
   • -2147483643 = Universal Security group
   If it's a Domain Local group trying to include members from another domain, that won't work. Change it to Universal if you need cross-domain membership.
5. Change the scope if needed – if groupType is wrong, close the dialog, then right-click the group > Properties > Attribute Editor tab. In newer Windows builds, you might see "Scope" directly. Set it to Universal. After clicking OK, you'll see a warning that it changes group behavior. Accept it.
6. Clear the membership cache – open PowerShell as admin. Run:

   Get-ADGroupMember -Identity "YourGroupName" | ForEach-Object { Remove-ADGroupMember -Identity "YourGroupName" -Members $_.DistinguishedName -Confirm:$false }

   This removes all current members. Then add them back one by one using ADUC.

After those steps, try adding the member again. You should see the user appear in the group list without the error.

Why This Works

Error 0XC002003A translates to "no more members" in Windows RPC. It happens when AD's internal lookup for group members runs out of entries. The most common reason I've seen is a group scope mismatch – for instance, a Domain Local group in Domain A tries to include a user from Domain B. Domain Local groups can only contain members from the same domain. Universal groups fix that.

Another cause is a corrupted membership attribute. The group's member attribute gets wonky after many additions/removals. Clearing it with PowerShell forces AD to rebuild the list cleanly. This matches what Microsoft's engineers told me once in a support call – they said "just blow away the membership and start fresh."

A third cause is replication delays – if you're on a multi-domain controller setup, the group might not have synced yet. That's rarer, though. The steps above handle 90% of cases.

Less Common Variations

1. LDAP Queries Returning Empty

If you're using a script or tool that queries group members via LDAP (like dsquery group -name "GroupName" | dsget group -members), you might get the same error. The fix is to use the memberOf attribute instead of member. For example:

dsquery * domainroot -filter "(&(objectClass=user)(memberOf=CN=GroupName,OU=Groups,DC=domain,DC=com))"

This bypasses the broken member list.

2. Nested Groups

Universal groups can contain other universal groups. But if you nest a Global group inside a Universal group, and that Global group has thousands of members, the lookup can time out. Error 0XC002003A pops up. Fix: flatten the nesting or move the members directly into the Universal group.

3. AD LDS or ADAM Instances

If this error happens on an AD LDS (Lightweight Directory Services) instance – not a full AD domain – the group membership limit is around 5000 members by default. You can increase it by editing the msDS-MaximumSize attribute on the group object using ADSI Edit. But I'd just split the group into smaller ones.

Prevention

You don't want to chase this error again. Here's how to avoid it:

• Plan group scopes before you create them. Universal groups for cross-domain needs. Global groups for same-domain roles. Domain Local for resources like printers.
• Keep membership under 5000 per group. Microsoft says it's a soft limit, but I've seen weird behavior above 10,000.
• Use PowerShell regularly to check group health. Run Get-ADGroup -Filter * -Properties Members | Where-Object { $_.Members.Count -gt 5000 } to find bloated groups.
• Monitor replication with repadmin /replsummary. If DCs aren't syncing, group changes can get lost.
• Document group changes. If someone adds a member and the error appears, you'll know it's a recent change. Roll it back.

One thing I tell all my techs: when you see 0XC002003A, don't panic. It's not a server failure. It's almost always a group misconfiguration. Follow the steps above, and you'll fix it in under 10 minutes.