Access Denied error when creating or editing an Active Directory Protection Templates (4294248)

Access Denied error when creating or editing an Active Directory Protection Templates

When attempting to create a new Active Directory Protection Template or edit an existing Active Directory Protection Template, a "Access Denied" error is displayed.  The user account is a member of the ChangeAuditor Administrators security group. If the user clicks OK to the "Access Denied" error message, they can continue to work with the Protection Template.

When ChangeAuditor starts a new Protection Template, or when editing an existing Protection Template, the ChangeAuditor Protection Template Wizard attempts to query the AD Schema for object attributes. If the user account logged on to ChangeAuditor is not a member of the Domain Admins Security Group, then the user does not have the required permission level to complete the query. The impact is that the second screen of the Wizard "(Optional) Select Attributes to Protect:" is blank and by default all Attributes would be protected by the template.

To avoid the "Access Denied" error message, the user account logged on to ChangeAuditor Client must be a member of the Domain Admins Security group to allow the query of the Active Directory Schema to be successful and ensure the second screen of the Wizard "(Optional) Select Attributes to Protect:" is populated; allowing the user the option of selecting which attributes they wish to protect.

Additional testing has also shown, that membership to the Schema Admins group will also correct this behavior - if membership to the Domain Admins group is not possible for any reason.