Re: How Can Admin Assistants Update Global Access Lists?
From: Jimmy Andersson [MVP] (jimmy_noSpam__at_mvps.org)
Date: 04/13/04
- Next message: Jimmy Andersson [MVP]: "Re: Transfer IM to a GC server"
- Previous message: Jimmy Andersson [MVP]: "Re: Operations Master is down."
- In reply to: Herb Martin: "Re: How Can Admin Assistants Update Global Access Lists?"
- Next in thread: Stefan Buchman: "Re: How Can Admin Assistants Update Global Access Lists?"
- Messages sorted by: [ date ] [ thread ]
Date: Tue, 13 Apr 2004 15:01:21 +0200
If you can't see the permission you need (I don't remember if its shown in
the UI by default) you need to edit the dssec.dat file. If the attribute is
=7 it means that it will not be displayed in the UI, you need to change it
to either 0,1 or 2. But this will only take care of the visibility in the
UI, you also need to change the DACL on the attribute.
0=Show Read/Write
1=Display Write
2=Display Read
To change the default schema DACL you can use dsacls, but if you do this,
the change will only be applied to objects that are created after the
change, i.e. objects that already exists will not be changed, you need to
script that or do it manually.
One thing you should be aware of is if you want to restore the Schema
defaults with dsacls later you will overwrite DACLs that applications might
have set, Exchange for instance.
In other words be sure to test this in a lab environment before doing it in
production.
Regards,
/Jimmy
-- Jimmy Andersson, Q Advice AB Microsoft MVP - Directory Services ---------- www.qadvice.com ---------- "Herb Martin" <news@LearnQuick.com> wrote in message news:evyeTkEIEHA.3820@tk2msftngp13.phx.gbl... > It is theoretically possible to delegate any property to > any user or group. > > Try the Delegation of Control Wizard (right-click in AD Users/Comp) > in the advanced section, custom area. > > If it's not there then you must use a scripting tool. Just this > weekend someone answered that they did this with LDIFDE > (or some tool, that I don't clearly remember) which > surprised me a bit but look into that general idea: using > scripting. > > -- > Herb Martin > "Max" <maxview80@hotmail.com> wrote in message > news:ttednezHcafchefd4p2dnA@comcast.com... > > What is the best way to allow department secretaries to update phone > numbers > > and other location info in Outlook for other employees without giving them > > any other rights over the accounts? > > > > > >
- Next message: Jimmy Andersson [MVP]: "Re: Transfer IM to a GC server"
- Previous message: Jimmy Andersson [MVP]: "Re: Operations Master is down."
- In reply to: Herb Martin: "Re: How Can Admin Assistants Update Global Access Lists?"
- Next in thread: Stefan Buchman: "Re: How Can Admin Assistants Update Global Access Lists?"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
