Grant account write access to specific attributes on Active Directory User object

Question

I am trying to allow an account to update very specific attributes on all User objects. I am setting this security on the "User" object. When I add the account on the security tab, go to advanced, edit the accounts permissions, and start going through the list of attributes I am only able to find a few, like First Name, but most of the attributes I want to let them write to are missing. How can I grant the account write access to these attributes?

Attributes I need to grant permission for:

• First Name (givenName)
• Last Name (sn)
• Initials (initials)
• Department (department)
• Company (company)
• Title (title)
• Manager (manager)
• Location Info (physicalDeliveryOfficeName, streetAddress, postOfficeBox)
• Work Phone (telephoneNumber)
• Pager (pager)
• IP Phone (ipPhone)
• IP Phone Other (otherIpPhone)
• ThumbnailLogo (thumbnailLogo)
• jpegPhoto (jpegPhoto)
• Description (displayName)

Thanks

Answer 1

I believe to get the full list you have to change "Apply onto" to "user" instead of "this object and all child objects". This changes the property selection dialog to include all of these.

Answer 2

Go to the "Advanced" ACL editor. Add the principal to whom the rights should be granted. In the "Permission for [principal name]" dialog, go to the "Properties" tab, choose "User objects" in the "Apply onto:" list, and select the properties and desired permissions from the list.

I spot-checked most of your list and I found everything I looked for there.