Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to delegate control in an Active Directory 2008 OU, so that a standard user is able to update the networkAddress attribute of a computer object?

I have logon script that queries WMI for the system manufacturer, product name, serial number and MAC addresses of a computer and saves the information back to active directory; the script works fine for administrators.

By delegating control of selected computer attributes to standard users, the script can be made to allow anyone to save the system manufacturer, product name and serial number to active directory, but I can’t find any way to make the networkAddress attribute writable; it isn’t listed as a writable attribute in the computer object (or any other class for that matter).

Is there an alternative attribute name or class I should be looking to delegate?

share|improve this question

The networkAddress attribute is used to store the subnet of a TCP/IP network and not MAC addresses. You're better off storing this information in some other attribute. (What attributes are you using to store the manufacturer, product, and serial number in, anyway? Generally I use "sn", "givenName", and "title" because these are valid attributes for the "computer" class but aren't used by computers.)

As an aside: It would be preferable, from a security perspective, to do this with a Startup Script and not a Logon Script. You can delegate Domain Computers access to update the attributes in the Directory rather than users. Assuming that your users don't have Administrator rights on the PCs you gain a measure of trust because non-Administrator users can't impersonate the computer's account easily.

share|improve this answer
Thanks for the comments. The script will evetually be used at startup rather than login, it is just easier to use the latter during testing. thanks for the pointer regarding the intended use for the networkAddress attribute, I never noticed that, I may just use another atribute or create my own to store MAC addresses now. – somnolent Mar 15 '12 at 16:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.