Adding AD user to group on Create

I have a simple create rule that I was using so that when adding a user they
would get added to a Security Group in AD. I kept getting "unwilling to
perform"

After troubleshooting for several hours, I decided to just try to add it
with an LDIF to verify it can be done. I still get "unwilling to perform"
using this simple LDIF

dn: CN=hector, ou=staff, dc=testad3,dc=usg,dc=edu
changetype: modify
add: memberof
memberof: cn=axgroup,ou=groups,ou=staff,dc=testad3,dc=usg,dc =edu

Perhaps I do not fully understand AD groups as opposed to Novell groups?

The above group and user exists. I can add manually through the AD console
and query the user to return that DN of the group.