specifically - a user in the TDAdmin group of LabManagement does NOT HAVE PERMISSION to run the IdentityChanger. This is ridiculous. TDAdmin is supposed to be "god". So, at least in 11.52, you must create a customer group so you can enable running IdentityChanger.
1. There is ZERO documentation about the above limitation
2. It took HP support 3 MONTHS to identify this problem
3. The error you get in IdentiyChange is unhelpful (which I believe is why it took support 3 months! They kept insisting that it was a problem of the IUSR_METRO account not having full admin rights, which is ridiculous as well.