Insufficient access rights to perform the operation (Exception from HRESULT:0x80072098) (80858)

User modification fails with the following error:

Insufficient access rights to perform the operation (Exception from HRESULT:0x80072098)

Other Symptoms:

• Most users can be successfully modified
• The modification fails for some 'random' users
  

1. Verify that the account running ActiveRoles Administration Service is an proper domain account and not a Local System account.
2. Perform the following steps in Active Directory Users and Computers (ADUC) snap-in to verify the effective permissions granted to the ActiveRoles service account
3. In ADUC, locate and right-click the user that cannot be modified
4. Select Properties and then select the Security tab
5. Click Advanced and select Effective Permissions
6. Click Select and type in the logon name of the ActiveRoles service account
7. Examine the list of effective permissions.
8. Select the Permissions tab
9. Verify that the Include inheritable permissions from this object's parent check box is selected

Notes:

The Include inheritable permissions from this object's parent check box may be unselected if the user or group is protected by Active Directory Domain Services AdminSDHolder. See the Additional Information section below for details.