Error from the ARS Web Interface: "You cannot program a Defender Desktop Token..." (4345441)

Error from the ARS Web Interface: "You cannot program a Defender Desktop Token..."

The complete error received is: "You cannot program a Defender Desktop Token as you have not been assigned the correct rights to create tokens."  This occurs when using the Defender Integration pack for ActiveRoles Server.

An Active Directory (AD) group has been delegated the "Defender- Administration" access template through ActiveRoles Server (ARS), but members of the group cannot program a Defender Token in the ActiveRoles Server web interface.  They can program a Defender Token in Active Directory using the native tools, i.e. ADUC.  They receive the message "You cannot program a Defender Desktop Token as you have not been assigned the correct rights" and the page is grayed out.

Insufficient permissions on the Defender OU in Active Directory.

This can also occur on x64 systems when the permissions on the DCOM object, DefCom32, is insufficient.

**Note: This may be because there are no available token or user licenses!**

First confirm that there are available licenses for both users and tokens.

On your Defender OU in AD, confirm in ARS that the group has the "Defender - Administrator" access template assigned and that you also assign "All Objects - Read All Properties" assigned.

The group needs permissions to write to the Tokens OU as well as update the license object under the Defender OU.

The OU where the users exist needs the "Defender - Administrator" access template assigned.

Please also ensure that permissions are propagated to AD from ARS.

On x64 systems, ensure that permissions are correct on the DefCom32 DCOM object. By default, the domain users group from the domain in which the system resides will have permissions, but not domain users from other domains that require access.