From c235e37367ef62fa3bd45b73d15e6c1d6a0f780b Mon Sep 17 00:00:00 2001
From: Meik <meik.drechsler@consulting4it.de>
Date: Tue, 10 Mar 2026 10:24:30 +0100
Subject: [PATCH] fix: require ntfs domain local tag only when needed

---
 LiamNtfs/C4IT.LIAM.Ntfs.cs | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/LiamNtfs/C4IT.LIAM.Ntfs.cs b/LiamNtfs/C4IT.LIAM.Ntfs.cs
index 8bf5fcd..63b9769 100644
--- a/LiamNtfs/C4IT.LIAM.Ntfs.cs
+++ b/LiamNtfs/C4IT.LIAM.Ntfs.cs
@@ -359,6 +359,10 @@ namespace C4IT.LIAM
             IEnumerable<string> readerSids,
             IEnumerable<string> writerSids)
         {
+            var requiresDomainLocalTag = this.GroupStrategy == eLiamGroupStrategies.Ntfs_AGDLP
+                || (NamingConventions ?? Enumerable.Empty<cLiamNamingConvention>())
+                    .Any(i => i.Scope == eLiamAccessRoleScopes.DomainLocal);
+
             var mergedCustomTags = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
             foreach (var tag in CustomTags)
                 mergedCustomTags[tag.Key] = tag.Value;
@@ -388,7 +392,7 @@ namespace C4IT.LIAM
                 groupWriteTag = GetRequiredCustomTag("Filesystem_GroupWriteTag"),
                 groupReadTag = GetRequiredCustomTag("Filesystem_GroupReadTag"),
                 groupTraverseTag = GetRequiredCustomTag("Filesystem_GroupTraverseTag"),
-                groupDLTag = GetRequiredCustomTag("Filesystem_GroupDomainLocalTag"),
+                groupDLTag = requiresDomainLocalTag ? GetRequiredCustomTag("Filesystem_GroupDomainLocalTag") : string.Empty,
                 groupGTag = GetRequiredCustomTag("Filesystem_GroupGlobalTag")
             };