Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to allow an account to update very specific attributes on all User objects. I am setting this security on the "User" object. When I add the account on the security tab, go to advanced, edit the accounts permissions, and start going through the list of attributes I am only able to find a few, like First Name, but most of the attributes I want to let them write to are missing. How can I grant the account write access to these attributes?

Attributes I need to grant permission for:

  • First Name (givenName)
  • Last Name (sn)
  • Initials (initials)
  • Department (department)
  • Company (company)
  • Title (title)
  • Manager (manager)
  • Location Info (physicalDeliveryOfficeName, streetAddress, postOfficeBox)
  • Work Phone (telephoneNumber)
  • Pager (pager)
  • IP Phone (ipPhone)
  • IP Phone Other (otherIpPhone)
  • ThumbnailLogo (thumbnailLogo)
  • jpegPhoto (jpegPhoto)
  • Description (displayName)


share|improve this question
It's much easier, safer, and probably better overall to do this via the Delegation of Control wizard. – joeqwerty Jun 16 '10 at 23:19
While the delegation wizard does allow you to customize access to many properties it does not show ALL of the properties we are trying to control access to. – Peter Jun 16 '10 at 23:54
up vote 1 down vote accepted

I believe to get the full list you have to change "Apply onto" to "user" instead of "this object and all child objects". This changes the property selection dialog to include all of these.

share|improve this answer
this was the first thing we tried... Most of them still did not show up. – Peter Jun 16 '10 at 23:53
I bet you have to also select "User" on apply-onto in the Object tab too. – sysadmin1138 Jun 17 '10 at 3:19
That was it, just had to pick user from the object tab as well. thanks. – Peter Jun 17 '10 at 19:58

Go to the "Advanced" ACL editor. Add the principal to whom the rights should be granted. In the "Permission for [principal name]" dialog, go to the "Properties" tab, choose "User objects" in the "Apply onto:" list, and select the properties and desired permissions from the list.

I spot-checked most of your list and I found everything I looked for there.

share|improve this answer
... I could swear this is exactly what we looked at earlier... except now I see them. I don't see Last Name/Surname, is it under a different name? – Peter Jun 17 '10 at 3:02

protected by Community Jul 16 '14 at 13:40

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.