4

I'm trying to find a way for users to change their job title or address in Active Directory. What i've done is pushed them a batch file as shown below so they can search for themselves in the AD

    @echo off
start Rundll32 dsquery.dll OpenQueryWindow

So far so good. Problem is that the users are not able to actually change their information. It seems to be read only.

After some searching on the internet i found that this may have something to do with permissions in Exhange 2010.

So i've taken a look at the Default Role Assignment Policy and it seems it's set correctly. It has all "MyContactInformation" enabled.

When going to webmail --> Options I can edit some information and it is stored within AD so that works, but i don't see fields like Job Title.

Is there a another way (without using 3rd party tools) users can change their title and department?

Greetings,

Lennart

  • 1
    This is strange. Why should users do that ? This is a setting for AD admins. If you want to automate things, you can use Set-ADUser "User01" -Department "HR" -Title "Slave" . I never seen a company where users set their own AD department info; this should be set by the AD admin according to the OU structure. – Overmind Apr 11 at 11:23
  • I realize this might seem strange to some. On the other hand i've seen it before in several companies but always with 3rd party tools, but that's a different conversation. Job title is actually the field i'm trying to let users change themselves. – Lennart Giaccotto Apr 11 at 11:36
  • Usually you can change your own details if you go to Explorer -> Network -> [Menu Network] -> Search Active Directory -> enter you own name -> search -> change what you need. Does this work for you? – Lenniey Apr 11 at 12:19
  • I just realized that you are doing the exact same thing, but calling the dialogue via your batch. So it obv. doesn't work for you (but it does for me in my AD). – Lenniey Apr 11 at 12:26
  • As for the permission problems: have you reviewed the user's security properties, especially the "SELF" group? – duenni Apr 11 at 13:12
4

Please check this related case, in this case Robbie_Roberts provided two options to allow users edit their job title by themself (Powershell or ECP). It is related to Exchange RBAC. I did a test with ECP, here are the commands:

New-ManagementRole -name "Mail Recipients Custom" -Parent "Mail Recipients"
Get-managementRoleEntry "Mail Recipients Custom\*" | where { $_.Name –ne "Set-User"} | Remove-ManagementRoleEntry
Set-ManagementRoleEntry "Mail Recipients Custom\Set-User" -Parameters Identity,Title,Department
Get-managementRoleEntry "Mail Recipients\Get-*" | Add-ManagementRoleEntry -Role "Mail Recipients Custom"
New-ManagementRoleAssignment -name "test" -Role "Mail Recipients Custom" -User a01 -RecipientRelativeWriteScope Self
New-ManagementRoleAssignment -role "View-Only Recipients" –user a01

Then I access ECP with a01 account and could edit his own Job and department, please note it could view other users information without editing. enter image description here

Hope it is helpful.

  • This looks very promising! thank you, i will dive into it! – Lennart Giaccotto Apr 12 at 8:16
  • I suppose you have Exchange integrated with your domain. In that case, the solution provided by @Shaw will work unless you dont allow updates from exchange to AD. In that case, review the interaction between both services and allow a bidirectional transfer of info. – Carlos Garcia Apr 12 at 8:20
  • I have indeed. only thing is that from what i can tell from the image above this is exchange 2013 or highter. we still user 2010. Title and Department are not visible in ECP – Lennart Giaccotto Apr 12 at 8:33
  • If using Exchange 2010, I think you may try the option 1 in the case, use remote powershell to modify the title. – Shaw Apr 15 at 9:25
1

There is no direct way to do this by the user, although it is possible via scripts.

rundll32 dsquery, OpenQueryWindow can do it if AD right to change the required fields on their AD account has been enabled.

Other methods such as using dsmod or powershell scripts would be too complicated for a normal user to do, but if you can make them properly run for them it could be an alternative.

  • This is what my batchfile does, but i think the problem for me is the missing rights for the users to self-update. I thought i could do this via exhange Role assignment but this does not make a difference outside webmail. – Lennart Giaccotto Apr 11 at 12:49
  • You need the AD rights, not exchange. – Overmind Apr 11 at 13:04
  • Is there a 'self service' rights group in ad present or do i need to create one? – Lennart Giaccotto Apr 11 at 13:32
  • I believe you can assign rights to SELF IIRC. Never tried it. – Harry Johnston Apr 11 at 22:54
  • I've tried! It indeed does make it possible for users to change their information. but altough i grant the rights to SELF it makes it possible to change it for all users... – Lennart Giaccotto Apr 12 at 10:06
0

You could use something like this: https://gallery.technet.microsoft.com/scriptcenter/GUI-for-AD-User-Attribute-b6ac7251 and adapt to your needs.

I have also seen this in conjunction with ticket systems as "Self-service portals".

Depending on your scripting skills, you could develop a simple website which fires the according powershell scripts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.