In my case this error occurred after I first delegated the 'reset password' right to the 'help desk' group, then reset the permissions to schema default using the wrong switch /resetDefaultDACL for...