title: Why does changing user's "Primary Group" from "Domain Users" in Active Directory stymie a recursive search for users?
body: <p>Given the following simple OU/Group hierarchy:</p>
  
  <pre><code>OU=MyApplication
      CN=CompanyClients(objectClass="group"; Members="Clients\Client1")
      OU=Clients
          CN=Client1(objectClass="group"; Members=".\client1-emp1; .\client1-emp2")
          CN=client1-Emp1 (objectClass="user"; Primary Group="Client1")
          CN=client1-Emp2 (objectClass="user"; Primary Group="Domain Users")
  </code></pre>
  
  <p>Why will the following recursive search omit client1-emp1 simply because its primary group is not set to either "Domain Users" or "Domain Guests"? Also, what other groups can be set as the primary group so that emp1 is successfully included in the search?</p>
  
  <pre><code>using System.DirectoryServices.AccountManagement;
  
  var ctx = new PrincipalContext(ContextType.Domain, "mydomain.org");
  var group = GroupPrincipal.FindByIdentity(ctx, IdentityType.SamAccountName, "CompanyClients");
  
  var results = group.GetMembers(recursive:true);
  //results excludes client1-emp1 but includes client1-emp2
  foreach (var principal in results)
  {
      Debug.WriteLine("Principal:" + principal.SamAccountName);
  }
  </code></pre>
  
  <p>Results:</p>
  
  <pre><code>Principal: client1-emp2
  </code></pre>