We have a tool being developed that will keep specific attributes of Active Directory user objects up to date with an authoritative source of employee information truth elsewhere, so that when someone's phone number or manager or location changes, Active Directory is automatically updated.
For normal users, delegation of manipulating to those properties is simple to handle using the delegation tools, but protected users, who have the
adminSDHolder ACL applied, it's more difficult.
When adding an ACE to the
adminSDHolder ACL using the UI, you're only able to grant access to all properties (which we don't want for security reasons), or properties that exist on the
adminSDHolder object itself - not user properties like
How do you grant access to specific properties of user objects under the protection of