Write right on single attribute in MS AD 2000?

[dodeesos]

Hi!

I am trying to figure out if its possible to give an user write rights to change a single attribute in our AD (2000) via LDAP (and only read on all other attributes)?

We have a setup where our AD feeds our pbx-db with email addresses via LDAP. We would like to feed the AD with extension numbers the other way around.
Right now the account used for the replication only have read access to the AD and it fells a little shaky to give the it full read/write access on the entire domain.

Any ideas?

 

[GeekITupSum]

have a look at this MS article i didnt read it all the way but from what i looked it, it could be possible

http://www.microsoft.com/technet/scriptcenter/topics/security/propset.mspx