active directory delegation

cawasaki
cawasaki used Ask the Experts™
on
hi,

i need to give in one account this right:

modify this attribute of all users in OU users:

departement
telephonenumber
employeetype
title

its is possible to do that?

i have an AD 2003 AND AD 2008R2

thanks
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Krzysztof PytkoSenior Active Directory Engineer
Top Expert 2012

Commented:
Yes it is. Please review articles on my blog for that and if you still need help, let me know
http://kpytko.wordpress.com/2012/05/16/active-directory-rights-delegation-overview/
http://kpytko.wordpress.com/2012/05/17/active-directory-rights-delegation-part-1/

Regards,
Krzysztof
Create a custom task to delegate -> Only the following object in the folder | User objects -> select Property-specific ->  

Read Department
Write Department

Read Job Title
Write Job Title

Read Telephone Number
Write Telephone Number

Where do you see Employee type?
Top Expert 2013

Commented:
going through the delegation control wizard you can get granular.  Select custom task and then user objects.  I just took some screen shots that may also help


1
 2
3
Thanks

Mike
Disregard I found it:

Read Employee Type
Write Employee Type

This should cover all 4 attributes you requested.

Author

Commented:
thanks

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial