[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1938
  • Last Modified:

Active Directory user object delegation - Write permissions for certain fields

I am trying to delegate write permissions to certain fields in user objects in the user ou.   I am able to delegate rights to certain fields without any problems...but I have yet been able to find the proper field names to delegate for other fields.   More directly..  I would like to give  a global group write access to the email field {General tab/Email Field} and I would also like to grant write access to office field {General tab/Office Field}   I have been able to grant write access to few other fields that I wanted {by delegation wizard or by manually adding rights under advanced options}.  In the end I just need to figure out what the field names are called in the delegate wizard menu {same names are used in advanced options}  Any help would be appreciated.  Thanks.
1 Solution
Below are the field names as they appear in ADSIEdit.msc from the Windows 2003 support tools which, as an aside, is one of the best tools for learning as well as troubleshooting....

email = mail (for Primary SMTP, which is the General Tab, Email Field)
email = ProxyAddresses (for other SMTP aliases)
office = physicalDeliveryOfficeName (General Tab, Office Field)

However, even though these are the field names you need, I do not see these fields in the delegate wizard, so it may not be possible to delegate permission to these fields through the Wizard.

This article from redmondmag.com may be helpful to you in further delegating permissions:

http://redmondmag.com/columns/print.asp?EditorialsID=617 - under the heading "How to Assign Permissions"  (about 1/3 down the page) it notes:

"Click the Properties tab and scroll through the list to find the properties. Youll find an entry corresponding to StreetAddress easily enough, but youll look in vain for the PhysicalDeliveryOfficeName"

Following below that are instructions for how to find and set things so you will ultimately be able to see that field in ADUC.

fertigjAuthor Commented:
That is exactly what I was looking for.  Thank you :)  

Featured Post

Get quick recovery of individual SharePoint items

Free tool – Veeam Explorer for Microsoft SharePoint, enables fast, easy restores of SharePoint sites, documents, libraries and lists — all with no agents to manage and no additional licenses to buy.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now