Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to give my bind user account the ability to write to the directReports attribute. When I get into the properties, almost every other attribute has a read and a write option. I only see "Read Direct Reports." No "Write Direct Reports."

This is AD 2003.

I've gone through the Delegate Control wizard and there was a Read and Write Direct Reports. I ticked both of them, tried to write, but still cannot.

Anybody know what's going on and why I can't delegate control to this attribute?

Thanks all!

share|improve this question
Well, it's looking like you can't directly write to it. But still odd you get the option to select it in the delegate control wizard. – cluckinchicken Apr 25 '12 at 23:33

Try using ADSI Edit to modify the ACL for the OU containing the users that you want your bind account to modify. ADSI Edit isn't as simple as the delegation wizard, but it does give you full control.

Another option would be to add your bind user account to the Account Operators security group, although that would allow it to modify all account properties and not just this particular one.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.