How to fix Error 1374 on Windows 11

by

Why This Error Happens

Windows requires every user account to have exactly one “primary group” assigned for legacy POSIX and Macintosh subsystem compatibility, even though most modern environments no longer use this feature actively. Error 1374 occurs because Active Directory Users and Computers (or the underlying directory service) will not allow removal of a group that is currently flagged as the primary group in the user’s primaryGroupID attribute. Essentially, the system is blocking the action to prevent the user account from being left without a required group association.

Step-by-Step Resolution Guide

Step 1: Identify the Current Primary Group

  • Open Active Directory Users and Computers (ADUC) on a domain controller or admin workstation with RSAT tools installed.
  • Navigate to the user account, right-click, and select Properties.
  • Go to the Member Of tab and note which group is currently set as the primary group (it will be labeled with “(Primary Group)” in some views, or check via PowerShell using Get-ADUser -Identity <username> -Properties primaryGroupID).

Step 2: Change the Primary Group to Domain Users

  • While still in the Member Of tab of the user’s Properties window, select a different group (typically Domain Users, since this is the default and safest option).
  • Click the Set Primary Group button to reassign it.
  • Apply the changes and click OK to save.

Step 3: Remove the Original Group Membership

  • Return to the Member Of tab.
  • Select the group you originally wanted to remove (it should no longer show as the primary group).
  • Click Remove, confirm the prompt, and click Apply.

Step 4: Validate via PowerShell (Optional for Bulk Fixes)

  • Run the following command to confirm the primary group ID has changed to Domain Users (RID 513):
Get-ADUser -Identity <username> -Properties primaryGroupID | Select primaryGroupID
  • If managing multiple accounts, use a script to loop through affected users and reset primaryGroupID to 513 before attempting group removal.

Alternative or Verification Steps

  • After completing the steps, reopen the user’s Member Of tab in ADUC and confirm the previously problematic group no longer appears in the list.
  • If the error persists, verify you have sufficient permissions (Domain Admin or delegated rights) on the OU containing the user object, as insufficient AD permissions can also trigger Error 1374 indirectly.