Delegate edit for specific user properties in MMC
Posted on 2004-04-21
I need to allow an administrative assistant the ability to update user properties in Active Directory for four tabs: General, Address, Telephones, and Organization. I know that I should be able to use the delegation wizard, but I haven't been able to find the appropriate properties for 'Create a custom task'. I've scanned through the DSSEC.DAT for the permissions, but there weren't many properties listed under the user heading.
Surely this specific customization has been done hundreds of times, why haven't I been able to find a single instance documented? The examples for customized delegation I've found are almost all brainlessly simple--how to enable a locked-out account is the prime example.
Can anyone give concrete details on accomplishing my goal? I'd prefer that only the four tabs listed for user properties display in the MMC, but I would accept all the properties tabs, if only the specified data could be edited.