c# - Unable to add/remove objects to group due to orphaned SIDs: PrincipalOperationException: An error (1332) occurred -

i need add/remove objects (users, groups) local group on server. below , works fine:

principal adobject = principal.findbyidentity(domaincontext, login); groupprincipal groupprincipal = groupprincipal.findbyidentity(machinecontext, identitytype.name, localgroupname); groupprincipal.members.add(adobject); groupprincipal.save(); 

except cases when local group contains orphaned sids (active directory users or groups deleted).

in case below exception:

system.directoryservices.accountmanagement.principaloperationexception: error (1332) occurred while enumerating group membership. member's sid not resolved. 

this error message appears when try add, remove , enumerate members in local group. while reading current members of group below workaround works fine:

directoryentry group = (directoryentry)groupprincipal.getunderlyingobject(); foreach (object member in (ienumerable)group.invoke("members", null)) {    ... } 

however converting groupprincipal directoryentry not solve issue adding , removing new members. have tried 3 methods below , none of them works:

1) group.invoke("add", new object[] {@"winnt://" + domain + "//" + login + ",user"}); 2) group.invoke("add", new object[] { @"ldap://" + adobject.distinguishedname }); 3) group.properties["member"].add(@"ldap://" + adobject.distinguishedname); 

all 3 cases above gives same error:

system.directoryservices.accountmanagement.principaloperationexception: error (1332) occurred while enumerating group membership.  member's sid not resolved. @ system.directoryservices.accountmanagement.sammembersset.islocalmember(byte[] sid) @ system.directoryservices.accountmanagement.sammembersset.movenextlocal() @ system.directoryservices.accountmanagement.sammembersset.movenext() @ system.directoryservices.accountmanagement.principalcollectionenumerator.movenext() @ system.directoryservices.accountmanagement.principalcollection.containsenumtest(principal principal) @ system.directoryservices.accountmanagement.principalcollection.add(principal principal) 

i need able add , remove users group without removing orphaned sids. can please suggest me solution/workaround problem?

it seems found workaround problem:

directoryentry group = (directoryentry)groupprincipal.getunderlyingobject(); iadsgroup nativegroup = (iadsgroup)group.nativeobject; // https://msdn.microsoft.com/en-us/library/aa706022(v=vs.85).aspx nativegroup.remove("ldap://" + adobject.sid.value); //nativegroup.remove(string.format("winnt:////{0}//{1}", domain, id)); //nativegroup.remove(string.format( "ntds:////{0}//{1}", domain, id)); 

if convert directoryentry native object , cast activeds.iadsgroup - add() , remove() methods works fine