Active Directory Domain Services was unable to delete the access control entry (ACE) for the domain Domain Controllers security ...

Active Directory Domain Services was unable to delete the access control entry (ACE) for the domain Domain Controllers security group on the newly created application directory partition. This ACE gave the domain Domain Controllers security group the Replication Get Changes All right for the following newly created application directory partition. 
 
Application directory partition: 
%3 
 
User Action 
Review the access control list (ACL) on the newly created application directory partition. Ensure the right Replication Get Changes All is given to both the Enterprise Domain Controllers group and the Enterprise Read-only Domain Controllers group, and remove that right from the domain Domain Controllers group. 
 
Additional Data 
Error value: 
%1 %2