Error: 'The AssistantAdmin does not have enough powers to run the 'UserSetInfo' operation' received (NETIQKB36674)

fact
Directory and Resource Administrator 6.50

symptom
Error: 'The AssistantAdmin does not have enough powers to run the 'UserSetInfo' operation' received by Assistant Admin  when trying to modify the property of a user although they have been delegated 'All Properties - Modify a User' power.

cause
This issue is caused by an authorization when the All Properties - Modify * power is delegated.  When an Assistant Admin (AA) is delegated the power 'All Properties - Modify a User account', there is a potential where the Admin Bit for authorization does not get retrieved and the result is the AA has no powers. 

fix

This issue is fixed in NetIQ Directory and Resource Administrator (DRA) 7.0.  Upgrade to the latest version of DRA to resolve this issue.

To workaround this issue in DRA 6.5:

1. Create a Custom Role.
2. Add all of the individual powers for modifying user accounts to the custom role.  ( Do not add  "All Properties - Modify a User Account")  Add powers like the following:
• Telephone Properties - Modify a User Account
• General Properties - Modify a User Account
• Password Properties - Modify a User Account
• WTS Properties... etc. etc.  
3. Delegate this custom role in place of the power All Properties - Modify a User Account.

Formerly known as NETIQKB36674