Preinstalled mode password sync error "Cannot install AePAgent" (4246881)

Password synchronization in Migration Manager has been configured as described in "Using Preinstalled Service Feature" chapter of Granular Account Permissions documentation. 

However whenever users are synchronized from the source AD to the target AD, the dsa.log contains errors similar to the following: Error 0xe1000051. Cannot compare password hashes, source user: "Test1", target user: "Test1" Error 0x80070005. Cannot install AePAgent. Cannot identify CPU type. Access is denied. (source=AePwd.PwdInstEx.1).

The user accounts get created on the target AD, but in "disabled" state. There are no firewalls enabled between source and target DCs and no AV products installed on them either.