Access Denied error when creating or editing an Active Directory Protection Templates (4294248)

When attempting to create a new Active Directory Protection Template or edit an existing Active Directory Protection Template, an "Access Denied" error is displayed. The user account is a member of the ChangeAuditor Administrators security group. If the user clicks OK on the error message, they can continue to work with the Protection Template.

The logged-on user does not have enough rights to query all AD objects and attributes (including flags) when configuring or editing a Protection template in the ChangeAuditor client.

To avoid this, the user account logged on to ChangeAuditor Client must be a member of the Domain Admins Security group to allow the query of the Active Directory Schema to be successful and ensure the second screen of the Wizard "(Optional) Select Attributes to Protect:" is populated; allowing the user the option of selecting which attributes they wish to protect.  In addition, always open the Change Auditor Windows client as Administrator to ensure UAC is not blocking permissions while on the GUI (Right-click on the CA Client icon > Run As... > Run As Administrator)