When navigating to Protection Templates in the ChangeAuditor Client, the Edit button is grayed out. The account is a member of the ChangeAuditor Administrator security group and is a member of the group specified as the Override account for the Protection Template. The user is able to edit a new Protection Template if it is created and the ChangeAuditor Administrator security group is listed as the Override account.
The user may receive errors stating "Unable to acquire exclusive access to Protection Templates. Locked by: Unknown. Changes will not be permitted"
原因
ChangeAuditor is not able to resolve the selected security group in Active Directory and allow the members to edit the template.
対策
To restore the ChangeAuditor Administrators ability to edit the Protection Templates, please follow these steps:
Open the SQL Server Management Studio on the SQL Server hosting the ChangeAuditor Database
Expand the Tables folder
Select top 1000 rows from Protect.GroupPolicyGroup and note the group IDs of the templates you can no longer edit
Select Edit top 200 rows from Protect.GroupPolicyAdminAccount, and delete the entire row for each of the group IDs obtained from step 2
The ChangeAuditor Administrators will now have access to these templates again
Note: This can also be used to gain access if the account or group authorized to edit the template cannot be used due to security reasons.
