I need to allow HR people to edit some attributes for all Active Directory users (phone numbers, address, and similar contact informations), without giving them full administrative rights. They will need the right to edit those attributes on all user accounts, regardless of the OU they're in, and this security setting should also be automatically applied to new user accounts when they are created.

How can I accomplish this?


You want to use the Delegate Permissions option in Active Directory Users and Computers. You can apply the delegation to whatever OU you want, including the domain root.

This will allow you to delegate whatever attribute-level permissions you want to whatever users/groups you define.

These permissions apply like any other and respect inheritance.

  • In our Windows Server 2008 R2 Environment, it's actually called 'Delegate Control' rather than permissions. I don't know if that changes in other versions Windows Server. – yougotiger Nov 5 '15 at 18:24

In ADUC, the Delegation of Control wizard will allow you to do this, using a custom task for delegation. Pick just the fields you want them to have Write access to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.