Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 151
  • Last Modified:

Enable a user to only change certain items in AD

We are running Win 2k server w/ Exchange 2k.  I need to enable the HR Mgr to edit personal info in the properties of each user so that it shows up in the Global Address List.  Is there a way to allow the HR Mgr to edit info in certain tabs of the users properties?  I would prefer not to give this person Account Operator permissions.  An example is this:

I create a new user named Jane Doe.  The HR Mgr now needs to enter Jane's info for address, telephones, organization in the corresponding tabs in AD Users.  The HR Mgr should not be able to edit any other tabs.

Thanks.
0
robinsonbpc
Asked:
robinsonbpc
  • 2
1 Solution
 
jhanceCommented:
That's a tricky problem.  I don't think you can selectively limit certain fields in the User Manager.  It an all or nothing proposition.  (Of course if there _is_ a way, I'm sure someone will point it out....)

I've seen this approached, however, using the following technique.  You need to use a SERVICE (and you probably need to either write one or get someone to write one) so that you have an application that runs with sufficient privilege on the machine to make the changes to the user account database.  The service either talks to the account management functions directly or uses one of the command line utils that modify user accounts to update the accounts.  Then you provide a user interface program that your HR guy can run that talks to the service.  The service only accepts certain requests from the user interface and so it only permits allowed operations.

It's a bit of work but I think this is the best way to accomplish this.
0
 
cempashaCommented:
Dear questionner/expert(s)

No comment has been added lately, so it's time to clean up this TA.
I'll leave a recommendation in the Cleanup topic area that this question is to be:

- PAQ'd and pts removed

Please leave any comments here within the next seven days.

==> PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER ! <==

PaSHa

Cleanup volunteer
0
 
jhanceCommented:
I disagree.  My comment is a valid solution here and should be FORCE ACCEPTED.
0
 
SpideyModCommented:
Answered by jhance

SpideyMod
Community Support Moderator @Experts Exchange
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now