title: Adding User to AD Security Group fails after user creation
body: <p>I am using a WCF service to expose certain Active Directory management functions to our help desk staff without giving them the group membership required to manipulate AD directly. Adding users to and removing users from groups is working like a champ with existing users, but every time I create a new user it throws back this fun code:</p>
  
  <pre><code>The server is unwilling to process the request. (Exception from HRESULT: 0x80072035)
  </code></pre>
  
  <p>The code I use to add the user to the group is</p>
  
  <pre><code>    public bool AddGroupToUser(string userDn, string groupDn)
      {
          try
          {
              DirectoryEntry groupEntry = LdapTools.GetDirectoryEntry(groupDn);
              groupEntry.Properties["member"].Add(userDn);
              groupEntry.CommitChanges();
              groupEntry.Close();
              return true;
          }
          catch (DirectoryServicesCOMException)
          {
              return false;
          }
      }
  </code></pre>
  
  <p>Everything I've read on the subject is rather vague and I can't seem to find out WHY the exception is being triggered. Any ideas?</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>This is the code I use to create the user in AD:</p>
  
  <pre><code>        try
          {
              DirectoryEntry container = GetDirectoryEntry(storageOu);
              DirectoryEntry newUser = container.Children.Add("CN=" + employee.FullName, "user");
              newUser.Properties["sAMAccountName"].Value = employee.Username;
              newUser.Properties["displayName"].Value = employee.FullName;
              newUser.Properties["givenName"].Value = employee.FirstName;
              newUser.Properties["sn"].Value = employee.LastName;
              newUser.Properties["department"].Value = departmentName;
              newUser.Properties["userPrincipalName"].Value = employee.Username + "@APEX.Local";
              newUser.CommitChanges();
  
              newUser.Invoke("SetPassword", new object[] { employee.Password });
              newUser.CommitChanges();
  
              AdsUserFlags userSettings = AdsUserFlags.NormalAccount;
              newUser.Properties["userAccountControl"].Value = userSettings;
              newUser.CommitChanges();
  
              ldapPath = newUser.Path;
  
              newUser.Close();
              container.Close();
          }
          catch (DirectoryServicesCOMException e)
          {
              // Something went wrong... what???
          }
          catch (Exception e)
          {
              // Something else went wrong
          }
  </code></pre>
  
  <p>The new user can login, and can be manipulated using the standard MS tools.</p>