0XC0000152: Account Not in Group – Fix Fast

Cause 1: Typo in the Account or Group Name (Most Common)

Half the time I see 0XC0000152, someone typed the account name wrong. Maybe you added a space at the end, or you're using a display name instead of the SAM account name. Windows is picky about this.

How to fix it – check the exact name

1. Open Command Prompt as Administrator. Click Start, type cmd, right-click it, and pick Run as administrator.
2. Type this to see all local groups:

   net localgroup

   You'll see a list. Write down the exact group name – case doesn't matter, but spaces do.
3. Now check the account name. If it's a local user, type:

   net user

   If it's a domain account, use:

   whoami /user

   That shows the exact SAM name (like DOMAIN\username).
4. Try adding the account again using the correct names:

   net localgroup "Administrators" "DOMAIN\username" /add

   After hitting Enter, you should see The command completed successfully. If you get 0XC0000152 again, move to Cause 2.

Cause 2: The Account Already Exists as a SID, Not a Name

This one trips up sysadmins all the time. When you remove a domain account from a group and then re-add it, Windows might still hold a stale Security Identifier (SID) reference. The error pops up because Windows sees the SID but not the friendly name.

How to fix it – remove the stale SID

1. Open PowerShell as Administrator.
2. Check the group's members:

   Get-LocalGroupMember -Group "Administrators"

   Look for any entry that shows a SID (like S-1-5-21-...) instead of a name like DOMAIN\username.
3. If you see a SID, remove it:

   Remove-LocalGroupMember -Group "Administrators" -Member "S-1-5-21-..."

   Replace the SID with the exact one you saw. Hit Enter. You'll get a confirmation – type Y if prompted.
4. Now add the account fresh:

   Add-LocalGroupMember -Group "Administrators" -Member "DOMAIN\username"

   If you see no errors, it worked.

Cause 3: Domain Controller Can't Resolve the Account (Domain Environments)

If you're in a domain and the error appears when adding a domain user to a local group, your workstation might not be able to contact the domain controller. This happens often after a password change or if the computer's trust relationship is broken.

How to fix it – test domain connectivity

1. Open Command Prompt (not as admin needed for this).
2. Run:

   nltest /dsgetdc:yourdomain.com

   Replace yourdomain.com with your actual domain name. You should see a line saying DC: \\DC-Server-Name. If you get an error like ERROR_NO_SUCH_DOMAIN, the computer can't find the domain.
3. If the DC is reachable, try resetting the computer's machine account password:

   nltest /sc_change_pwd:yourdomain.com

   This forces a secure channel refresh. Wait 30 seconds, then retry adding the account.
4. If that fails, you might need to rejoin the domain. That's a bigger fix – talk to your domain admin before doing it. But 9 times out of 10, a password reset fixes it.

Quick-Reference Summary Table

That's it. Start with the typo check – I'd say 60% of cases end there. If you're still stuck after trying all three, it's worth checking if the account is disabled or locked out in Active Directory. Run net user DOMAIN\username /domain to see the account status. Good luck.