Delegating write access to networkAddress attribute

Question

Is it possible to delegate control in an Active Directory 2008 OU, so that a standard user is able to update the networkAddress attribute of a computer object?

I have logon script that queries WMI for the system manufacturer, product name, serial number and MAC addresses of a computer and saves the information back to active directory; the script works fine for administrators.

By delegating control of selected computer attributes to standard users, the script can be made to allow anyone to save the system manufacturer, product name and serial number to active directory, but I can’t find any way to make the networkAddress attribute writable; it isn’t listed as a writable attribute in the computer object (or any other class for that matter).

Is there an alternative attribute name or class I should be looking to delegate?

Answer 1

The networkAddress attribute is used to store the subnet of a TCP/IP network and not MAC addresses. You're better off storing this information in some other attribute. (What attributes are you using to store the manufacturer, product, and serial number in, anyway? Generally I use "sn", "givenName", and "title" because these are valid attributes for the "computer" class but aren't used by computers.)

As an aside: It would be preferable, from a security perspective, to do this with a Startup Script and not a Logon Script. You can delegate Domain Computers access to update the attributes in the Directory rather than users. Assuming that your users don't have Administrator rights on the PCs you gain a measure of trust because non-Administrator users can't impersonate the computer's account easily.