How to fix Error 1372 on Windows 11

by

Troubleshooting Guide: Error 1372 – “Cannot Perform This Operation on This Built-In Special Group”

Why This Error Happens

This error occurs when an administrator or a script attempts to modify, rename, delete, or change the membership properties of a built-in special group, such as “Everyone,” “Authenticated Users,” “SYSTEM,” “Interactive,” or “NETWORK.” These groups are not stored in the standard SAM database or Active Directory like regular security groups; instead, they are computed dynamically by the operating system based on the context of the logon session. Because Windows manages these memberships automatically at the kernel level, no user—including Administrators—has the permission structure required to alter them manually via standard tools like net localgroup or Active Directory Users and Computers (ADUC).

Step-by-Step Resolution Guide

Step 1: Identify the Offending Command or Script

  • Determine exactly which action triggered Error 1372. This is common when running batch scripts or PowerShell commands that loop through Security Identifiers (SIDs) to modify group memberships.
  • Check Event Viewer (eventvwr.msc) under Windows Logs > System for the specific command context that failed.
  • If using PowerShell, check the specific cmdlet, such as Add-LocalGroupMember or net localgroup [group] [user] /add.

Step 2: Verify the Target Group Name

  • Ensure the script or command is not mistakenly targeting a special identity instead of a custom Security Group.
  • Special groups to avoid modifying include: Everyone, SYSTEM, NETWORK SERVICE, Authenticated Users, INTERACTIVE, and BATCH.
  • If you intended to grant permissions, use the Security tab of the file/folder/registry key properties instead of attempting to add a user to the special group.

Step 3: Adjust the Script to Use Standard ACLs

  • Rewrite the logic to use Access Control Lists (ACLs) rather than Group Membership changes for special identities.
  • Open PowerShell as Administrator and use Get-Acl and Set-Acl to modify permissions instead of Add-LocalGroupMember.
  • Example correction: Instead of adding a user to “Everyone,” grant the specific user or a custom group “Read” or “Modify” rights directly on the resource (file, folder, or registry key).

Step 4: Create a Custom Security Group (If Grouping is Required)

  • If the goal was to manage a specific set of users with special permissions, create a new Local or Domain Security Group instead.
  • Navigate to Computer Management > Local Users and Groups > Groups (for local machines) or ADUC for domain environments.
  • Right-click Groups, select New Group, and add the specific standard user accounts you intended to manage. Apply permissions to this new custom group instead.

Alternative or Verification Steps

  • Verify the Fix: Re-run the original script or command against the newly created custom Security Group (from Step 4) rather than the built-in special identity. The operation should complete without generating Error 1372.
  • Alternative Check: If the error persists on a custom group (which would be unusual), verify the group’s SID hasn’t been corrupted using Get-LocalGroup | Select Name, SID in PowerShell to ensure you are not accidentally referencing a system-reserved SID range.