ADSI - The server is unwilling to process the request

[ThunderForest]

This seems to be more of an Active Directory expert question, so hopefully I have the right forum. I've written a lightweight Active Directory management program that modifies user attributes, adds and removes groups, and disables user accounts. Everything works fine except this scenario, where I receive the "The server is unwilling to process the request" error:

When I bind to groupFrom:

LDAP://Domain.abc.cde/CN=GroupFrom,CN=Location1,CN=Users,DC=abc,DC=cde

I can't add it to groupTo:

LDAP://Domain.abc.cde/CN=GroupTo,CN=Recipients,CN=Users,DC=abc,DC=cde

Note the difference in paths. I've narrowed down the problem as being due to some difference between CN=Location1 and CN=Recipients, but I don't know why it's a problem. I have domain admin rights.

On the other hand, if I bind to GroupA:

LDAP://Domain.abc.cde/CN=GroupA,CN=Recipients,CN=Users,DC=abc,DC=cde

and add that to GroupB:

LDAP://Domain.abc.cde/CN=GroupB,CN=Recipients,CN=Users,DC=abc,DC=cde

The paths are identical and it works just fine. It seems I can add a group to a group or a user to a group, but only if the LDAP path is the same in both. What AD restriction, if any, am I not understanding? Can you only add an object that has the same LDAP path as the container you bind to?

My application code is standard:

grp:= GetObject(groupAStr) as IADsGroup;
grp.Add(groupBStr);

Thanks.


Getting answers before I'm asked.
Providing answers if I can.

 

[ThunderForest]

Sorry. I should have posted in MS Server.

Getting answers before I'm asked.
Providing answers if I can.