Delegate change Office permission

[Curtis Fray]

Hi,

Could someone tell me how I delegate permission in Active Directory to allow
a group to change the "Office" filed in a user object?

Thanks,

Curtis.

 

[Tomasz Onyszko]

Hi,

Could someone tell me how I delegate permission in Active Directory to allow
a group to change the "Office" filed in a user object?

You have to set permission for them to this object - If You can't find
it on the tab with permissions check and edit dssec.dat file:

http://www.windowsitpro.com/Article/ArticleID/9187/9187.html
http://www.windowsitpro.com/WindowsSecurity/Article/ArticleID/25732/25732.html

 

[Jorge de Almeida Pinto [MVP]]

If for some reason you want to delegate the use of some attribute and that
attribute is not listed in the in the property/attribute specific list, then
that attribute is hidden from being viewed. To be able to use that attribute
in the delegation of control wizard on THAT SPECIFIC DC, open DSSEC.DAT in
%WINDIR%\SYSTEM32, search for the attribute you want to use (make sure you
are making changes under the correct [OBJECT]) and change the value 7 to a
value 0 (zero). Save DSSEC.DAT and RE-OPEN Active Directory Users and
Computers. Before doing this make copy of the original DSSEC.DAT (e.g.
DSSEC.DAT.ORG) and after doing this make a copy of the changed DSSSEC.DAT
(e.g. DSSEC.DAT.CUST) (if for some reason a hotfix or SP replaces the file
you have lost your changes)

In your case look for physicalDeliveryOfficeName=7 under [user]

after setting this to 0 you will see it in the deleg wizard.

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx

 

[Curtis Fray]

Thanks for the tips. That's got it working!

Regards,

Curtis.