title: Add local group to CN=Readers,CN=Roles in AD LDS partition in C#
body: <p>I am using AD LDS on Windows 7 and created a local instance with a new application partition using the adaminstall utility.</p>
  
  <p>How can I add an existing local Windows group to the Readers role of this partition?</p>
  
  <p>I want to achieve the same result programmatically (in C#) that are given by the following manual steps:</p>
  
  <ol>
  <li>Start ADSI Edit and connect to the AD LDS instance and partition.</li>
  <li>Navigate to CN=Readers below the partition root node.</li>
  <li>Double-click the CN=Readers entry.</li>
  <li>Double-Click the "member" attribute.</li>
  <li>Select and add an existing local Windows group.</li>
  </ol>
  
  <p>I already have the following C# code:</p>
  
  <pre><code>public void AddReader(string partitionName, string accountName)
  {
    var ntAccount = new NTAccount(accountName);
    var securityIdentifer = ntAccount.Translate(typeof(SecurityIdentifier));
    var accountNameDN = string.Format("CN={0},CN=ForeignSecurityPrincipals,{1}", securityIdentifer.Value, partitionName);
  
    var rootPath = string.Format("LDAP://localhost:389/CN=Readers,CN=Roles,{0}", partitionName)
    var directoryEntry = new DirectoryEntry(RootPath);
    directoryEntry.Properties["member"].Add(accountNameDN);
    directoryEntry.CommitChanges();
  }
  </code></pre>
  
  <p>This code works only if the local group has at least been added once to the Readers role using the manual steps described above. If I add the group manually and then remove it manually, the code shown above can be used to re-add the group again.</p>
  
  <p>But when I try to add a new local Windows group, the <code>CommitChanges()</code> call in the code above throws a <code>DirectoryServicesCOMException</code> with error code <code>0x8007002F</code> and message <code>A constraint violation occurred</code>.</p>
  
  <p>Obviously the manual steps perform some modification on the existing local Windows group that make it suitable for being added to the AD LDS Readers role. But what am I missing?</p>
  
  <p>I think there must be a better way than my approach using the <code>ActiveDirectorySecurity</code> and <code>ActiveDirectoryAccessRule</code> classes, but I cannot figure out how to use them.</p>