The “ChangeAuditor Agents” security group is only created in the domain where the Agent Installer is pointed when installed in foreign forest or workgroup computer (4220113)

1. Change Auditor coordinators are installed in a multi-domain forest. There are coordinators installed in the root domain (RootDomain1) and a child domain (ChildDomain1)
2. The Change Auditor Agent is installed in a foreign forest domain and the installer is pointed to RootDomain1
3. The “ChangeAuditor Agents”  group is created only in RootDomain1
4. Agents installed in the foreign forest will not connect to the coordinators in ChildDomain1
5. Coordinator log in the child domain shows a warning "Request for principal permission failed " along with a detailed exception:
   System.Security.SecurityException: Request for principal permission failed
      at System.Security.Permissions.PrincipalPermission.ThrowSecurityException()
      at System.Security.Permissions.PrincipalPermission.Demand()
      at ChangeAuditor.Coordinator.Agent.AgentService.Authorize()
      at ChangeAuditor.Coordinator.Agent.AgentServiceBase.Connect(String agentName, Guid agentID, String agentVersion)
   
   The action that failed was:
   Demand
   The type of the first permission that failed was:
   System.Security.Permissions.PrincipalPermission
   The first permission that failed was:
   <IPermission class="System.Security.Permissions.PrincipalPermission, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
   version="1">
   <Identity Authenticated="true"
   Role="ChildDomain1.RootDomain1.com\ChangeAuditor Agents – DEFAULT"/>
   </IPermission>

WORKAROUND:

1. Manually create the "ChangeAuditor Agents - DEFAULT" domain local security group in the child domain and add the user account specified during the agent installation in the foreign forest
2. Restart the Change Auditor agent service

STATUS: