Daniel Ramawidjaja Blog

July 25, 2009

Delegation Control to Modify Only Certain User Attributes (Part 2)

Filed under: Active Directory,Windows Server — Daniel Ramawidjaja @ 9:33 am

In this post, I will explain how to delegate certain users to be able to modify attributes that can not be delegated by using Delegation of Control Wizard. Not all attributes can be delegated using the wizard, without allowing other attributes that you do not want to delegate.
For example, Office location. You can delegate the Office location attribute by selecting Read/Write Permissions for Private Information. But, may be you need to for the delegation to be more specific. In this case, using ADSIEDIT.MSC.

If you do not have ADSIEDIT.MSC ready (test by run ADSIEDIT.MSC from Run), you should install first.
It’s available on the Windows Server 2003 CD, in folder \Support\Tools. Install by double-click on suptools.msi.
For Windows Server 2008, it has been available on the Domain Controller since you installed the Active Directory.

Create connection to open the Domain partition.
Then you can modify the permissions of an OU just like the following picture:

Custom Delegation (Part 2)

This tip has been tested to work successfully, such as in the following picture.

Custom Delegation (Part 2)

The Office location attribute was changed to Semarang.

Custom Delegation (Part 2)


1 Comment »

  1. This worked for me! Been trying to find this for a while 🙂 Thank you

    Comment by Nate — February 10, 2011 @ 3:47 pm | Reply

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

Blog at WordPress.com.

%d bloggers like this: