All new domain users are automatically added to the “Domain Users” group. This group is also set as the primary group. If for any reason you need to remove an account from “Domain Users”, you must first assign another primary group. Active directory simply won’t allow you to remove user from its primary group:


You may come across situation where you can’t change primary group because “Set Primary Group” button is greyed out.

Normally this occurs because you are trying to make a built-in group as primary (such as Users, Backup Operators, etc). To resolve simply create a new Global Security group and use it as primary group when required. Obviously you can also use any of your existing Global user groups.

Windows Server 2003 Domain