Constraint violation when trying to set "User Cannot Change Password" in active directory from c# -

i've tried multiple ways set flag "user cannot change password" in active directory c#.

the following haven't worked:

• setting "cannotchangepassword" true on user principle object
• setting access rules on user object security on directory entry (http://urslisworld.blogspot.ca/2010/02/set-user-cannot-change-password-in-c.html)
• directly setting ntsecuritydescriptor (http://sourcefield.blogspot.ca/2009/12/cactivedirectory-check-user-cannot.html)
• and of course, can't directly set user account control property according https://support.microsoft.com/en-us/kb/305144

the first 3 each give exact same, highly cryptic error message, "constraint violation" extended message:

0000051b: atrerr: dsid-030f20ba, #1: 0: 0000051b: dsid-030f20ba, problem 1005 (constraint_att_type), data 0, att 20119 (ntsecuritydescriptor) 

here simplest case code should have worked (option 1):

using (var context = new principalcontext(contexttype.domain, mydomain, myaccountoperatorusername, myaccountoperatorpassword)) {     using (var user = userprincipal.findbyidentity(context, identitytype.samaccountname, usernametochange))     {         if (user != null)         {             user.usercannotchangepassword = true;              user.save()         }     } } 

the powershell way of doing works fine, using same credentials same machine. in fact, works can automate in code , succeeds:

using (var powershellinstance = powershell.create()) {     powershellinstance.addscript("import-module active-directory");     powershellinstance.addscript("$password = convertto-securestring \"" + myaccountoperatorpassword + "\" -asplaintext -force");     powershellinstance.addscript("$cred = new-object -typename system.management.automation.pscredential -argumentlist \"" + myaccountoperatorusername + "\", $password");     powershellinstance.addscript("set-adaccountcontrol -identity " + usernametochange + " -cannotchangepassword $true -credential $cred");      var psoutput = powershellinstance.invoke();  } 

however powershell way makes deployment more complicated should accomplishable in pure c#.

is problem domain, environment code running in, or code itself?