Workflow throwing error after approval operation is successful on Active Roles version 7.5

What is the scope of the group that the user is being added to - i.e. Global, Domain Local, Universal?

Is it possible that the user you are trying to add to the group cannot be because for example, the group is Global in DomainA and the user is from Domain B?

Thanks for reply. The user and group belong to the same domain. It allows to add group manually to user if i disable the workflow. But we need the workflow because of the approval process.

If you launch (i.e RunAs) ADUC as your Active Roles service account (or domain override account if configured), are you able to add the user to the group in question?

The group did not get added to user, after Workflow 'Run as' option is setup to run as 'The service account of active Roles'. The approval showed the operation as successful on user interface when request is approved. But the group did not get added to the user.

What I am trying to get you to do is test the native rights of your Active Roles Service Account or Override account.  My suspicion is that it's possible that the account executing the operation doesn't have rights to add users to this group for some reason.

Another alternative would be to attempt the operation using Powershell but again, you would need to run the script as your Active Roles service account.

The service account has permissions to add user to the group. The powershell script has added the user to the group when the script is run with service account credentials. It appears the workflow is breaking the operation. Is there a way to debug the workflow. Below is the error from the event viewer.

Initiator: PLANT\AccountAdmin
Details: serviceExecutionActivity1 activity has terminated this workflow instance.
Administration Service encountered an error when making changes to the object 'CN=7CB_Sec_SuperMaster,OU=Security Groups,OU=7Cowboy,OU=South2,OU=Wind,DC=xxxxx,DC=xxxxx,DC=com'.
An internal error occurred. (Exception from HRESULT: 0x8007054F)

The service account has permissions to add user to the group. The powershell script has added the user to the group when the script is run with service account credentials. It appears the workflow is breaking the operation. Is there a way to debug the workflow. Below is the error from the event viewer.

Initiator: PLANT\AccountAdmin
Details: serviceExecutionActivity1 activity has terminated this workflow instance.
Administration Service encountered an error when making changes to the object 'CN=7CB_Sec_SuperMaster,OU=Security Groups,OU=7Cowboy,OU=South2,OU=Wind,DC=xxxxx,DC=xxxxx,DC=com'.
An internal error occurred. (Exception from HRESULT: 0x8007054F)

Are you using a Workflow Activity to add the user to the group or are you just relying on the "native" operation being allowed to finish when the Approval occurs?