Error: 'Error saving the changes to the User. Access is denied.' when cloning a user account. (NETIQKB44154)

fact
Directory and Resource Administrator 7.x

symptom
Error: 'Error saving the changes to the User.  Access is denied.' when cloning a user account.

symptom
Error is received while logged in as an Assistant Admin, Directory and Resource Administrator (DRA) Administrator or with the DRA Service Account.  It makes no difference if the source object is mail-enabled, has a home share or has a home directory.

cause
There is an Active Directory property field on the source or template user account that the Directory and Resource Administrator (DRA) Service Account does not have permission to modify.

fix

If a System-Only property field is populated in Active Directory (AD), Directory and Resource Administrator (DRA) will not have access to this property field during the UserClone process.  This issue has been known to occur with the following property value:

•  Property: msDS-Site-Affinity

To resolve this issue, create a Clone Exception for the specific System-Only property attribute.

For information on how to create Clone Exceptions, see the following Knowledge Base article:

• NETIQKB3604:How do I specify or customize which properties to exclude during clone operations?

 

Formerly known as NETIQKB44154