If local Administrators group has been removed from an ACL on a member server, can DMA still transla (NETIQKB28513)

goal
If local Administrators group has been removed from an ACL on a member server, can DMA still translate security on it?

fact
Domain Migration Administrator 7.x

fix

The account that you have logged in to the Domain Migration Administrator (DMA) console with must be a member of the local Administrators group on the computer where you are translating security.  If this criteria is met, DMA will be able to translate security on the ACL even if the logged in account does not have any permissions on that Access Control List.  Once installed, the agent makes the changes to ACL's under the context of Local System.

Formerly known as NETIQKB28513