Delegation Control to Modify Only Certain User Attributes (Part 1)

Based on my student request, I post an article about custom delegation task in Active Directory. This delegation will allow user with specific function, for example, Human Resource to edit only certain properties of users in certain OUs.

User Attributes that can be changed after the custom delegation:
Job Title, Department, Company, Manager, and Direct Reports.

Testing will be done by user Jet Lee (JetL) as a member of Human Resources group.

 

Attributes that Will Be Allowed to Be Changed in This Custom Delegation Example

 

Delegation Control Steps
Right-click on Finance OU, for example, and then click Delegate Control. It will launch the Delegation of Control Wizard.

Select users or groups for delegation

Select Create a custom task to delegate

Select Only the following objects in the folder, then select User objects.

On the Permissions page, select Property-specific. Then select read and write permissions for the following attribute:
– Department
– Job Title
– Company
– Direct Reports
– Manager
Click Next, and then click Finish.

 

Test the Delegation
For testing I use user Jet Lee (JetL) that is a member of Human Resources group.

Now, JetL can modify the user properties in the Organization tab like the following picture:

Here the result of setting the Manager property as you can see in Direct Reports list in the user properties for the manager (NaomiW)