Allow Admin Asst to Edit AD User Properties - How? 2

[mthomasdd]

An administrative assistant is assigned to edit the user properties so that Outlook Address Book will show correct titles, telephone numbers, addresses, etc. when things change.

I cannot give this user administrator network rights nor do I want to have them browsing around in Active Directory Microsoft Management Console.

How is this commonly done?

Thanks.

 

[adcfaq]

delerate control your AA to a specfic OU, move all users into that OU, assign approperite permission for AA.

 

[markdmac]

As stated above you will want to delegate rights. Beyond that you will want to create a custom MMC for them and lock it down so they can't modify it.

I would suggest giving this user a special ID to perform these tasks and not delegating to their normal user ID.

As an alternative to the delegation, you could have this person update an Excel spreadsheet that tracks the proper information and then run a script to do the actual updates. Doing it this way you could have the assistant do the "work" of keeping the information up to date and then you as admin just run the script.

I recently created and posted such a script. thread931-1069415. All you would need to do is add extra columns for the data you want to track.

Note, the script will take less time to execute if your spreadsheet only includes information for the users who's data has changed.

I hope you find this post helpful.

Regards,

Mark

 

[mthomasdd]

Thanks for the info.

The Delegate Control wizard, new user ID, and custom MMC gave me what I needed.

Thanks again.