Convert a Group to Another Type

Applies To: Windows Server 2008, Windows Server 2008 R2, Windows Server 2012

Membership in Account Operators , Domain Admins , or Enterprise Admins , or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at https://go.microsoft.com/fwlink/?LinkId=83477.

• Using the Windows interface

• Using a command line

1. To open Active Directory Users and Computers, click Start , click Control Panel , double-click Administrative Tools , and then double-click Active Directory Users and Computers .

   To open Active Directory Users and Computers in Windows Server® 2012, click Start , type dsa.msc .

2. In the console tree, click the folder that contains the group that you want to convert to another group type.

   Where?

   • Active Directory Users and Computers\ domain node \ folder that contains the group

3. In the details pane, right-click the group, and then click Properties .

4. On the General tab, under Grouptype , click the group type.

• To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in Active Directory Domain Services (AD DS), or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

• To convert a group, the domain functional level must be set to Windows 2000 native or higher. Groups cannot be converted when the domain functional level is set to Windows 2000 mixed.

• You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start , click Administrative Tools , and then click Active Directory Module for Windows PowerShell .

  To open the Active Directory module for Windows PowerShell in Windows Server 2012, open Server Manager , click Tools and then click Active Directory Module for Windows PowerShell .

  For more information, see Convert a Group to Another Type (https://go.microsoft.com/fwlink/?LinkId=180675). For more information about Windows PowerShell, see Windows PowerShell (https://go.microsoft.com/fwlink/?LinkID=102372).

• Managing Groups

1. To open a command prompt, click Start , click Run , type cmd , and then click OK .

   To open a command prompt in Windows Server 2012, click Start , type cmd , and then click OK .

2. Type the following command, and then press ENTER:

   dsmod group  <GroupDN> -secgrp {yes|no}
   

To view the complete syntax for this command, and for information about entering user account information, at a command prompt, type the following command, and then press ENTER:

dsmod group /? 

• To perform this procedure, you must be a member of the Account Operators group, Domain Admins group, or Enterprise Admins group in AD DS, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.

• To convert a group, the domain functional level must be set to Windows 2000 native or higher. Groups cannot be converted when the domain functional level is set to Windows 2000 mixed.

• You can also perform the task in this procedure by using the Active Directory module for Windows PowerShell. To open the Active Directory module, click Start , click Administrative Tools , and then click Active Directory Module for Windows PowerShell .

  To open the Active Directory module in Windows Server 2012, open Server Manager , click Tools and then click Active Directory Module for Windows PowerShell .

  For more information, see Convert a Group to Another Type (https://go.microsoft.com/fwlink/?LinkId=138379). For more information about Windows PowerShell, see Windows PowerShell (https://go.microsoft.com/fwlink/?LinkID=102372).

• Managing Groups