Some users unable to create their questions and answers profiles (4249724)

Some users receive an error when trying to create their questions and answers profile through the Password Manager web interface.

Users may see the following error displayed in the Password Manager web interface.

Some errors occurred while creating Questions and Answers profile

System error occurred. Contact your administrator.

If logging is enabled, you will see entries in the QPM.SERVICE.HOST log as follows:

System.UnauthorizedAccessException: Access is denied.

This is due to missing permissions on the user's account object in Active Directory.  The usual cause for this when only some users are experiencing this problem is permission inheritance is not enabled on their account.

Using Active Directory Users and Computers, find the user accounts affected and perform the follow to each:

1. Open the user object's properties window.

2. Click the Security tab.

If the Security tab is not present, in the main ADUC window, click the View menu and select Advanced Features.  The Security tab should now be present.

3. Click the Advanced button.

4. For Windows Server 2008 and below, check off the option "Include inheritable permissions from this object's parent".

For Windows Server 2012, click the "Enable inheritance" button.

5. Click Ok.