Active Directory

Delegating Active Directory attribute physicalDeliveryOfficeName

Being responsible for Active Directory you're often tasked with fairly simple task of delegating permissions for user and groups. After doing it multiple times you know how to do it, but then you're told to delegate only one attribute physicalDeliveryOfficeName and things get complicated.

Problem Description

Normally delegating attributes in Active Directory is simple walk in a park.

You open up Active Directory Users and Computers

Right click on click on root of the domain or the object you want to delegate permissions on choose Delegate Control…

Follow Delegation of Control Wizard

Select User or Groups to delegate permissions to (obviously choose Groups)

Choose Create a custom task to delegate

Choose Only the following objects in the folder, and select User objects

And then, uncheck General, choose Property-Specific and find your precious property such as physicalDeliveryOfficeName that you were looking for on the list.

The only problem… it's not on the list. So you cancel, and go for the more direct approach.. modifying security properties directly.

You choose Properties, go to Security tab and press Advanced.

Then you choose Add permission, you choose your principal group, you choose Type to Allow, Applies to: Descendant User objects… finally you uncheck not needed permissions, and then you find there's no such field as physicalDeliveryOfficeName on that list!

Solution

As bad as it sounds I was really stomped. Either I am blind or something is seriously missing. It turns out it is missing and unless you enable it it's gonna stay invisible. The solution is quite simple:

Close all instances of Active Directory Users and Computers

Open Windows Explorer and go to C:\Windows\System32 and find dssec.dat file

Make yourself a copy of that file in case things get ugly. The file holds settings for each value for that is supposed to be filtered out of delegation/security tabs.

Find [user] section (or any section you want that property to be visible at and change physicalDeliveryOfficeName=7 to physicalDeliveryOfficeName=0.

Now open up Active Directory Users and Computers and it should be there… although not in the form you expected it. The property is called Office Location.

And if you're wondering now if it was there all along.. well I did wonder myself so I've checked on different AD controller… and as you can see below it's not there.

Notes

The Per-Property Permissions tab for a user object that you view through Active Directory Users and Computers may not display every property of the user object. This is because the user interface for access control filters out object and property types to make the list easier to manage. While the properties of an object are defined in the schema, the list of filtered properties that are displayed is stored in the Dssec.dat file that is located in the %systemroot%\System32 folder on all domain controllers. You can edit the entries for an object in the file to display the filtered properties through the user interface. A filtered property looks like this in the Dssec.dat file:

[User]
propertyname=7

To display the read and write permissions for a property of an object, you can edit the filter value to display one or both of the permissions. To display both the read and write permissions for a property, change the value to zero (0):

[User]
propertyname=0

To display only the write permission for a property, change the value to 1:

[User]
propertyname=1

To display only the read permissions for a property, change the value to 2:

[User]
propertyname=2
After you edit the Dssec.dat file, you must quit and restart Active Directory Users and Computers to see the properties that are no longer filtered. The file is also machine specific so changing it on one machine doesn't update all others. It's up to you whether you want it visible everywhere or not.

Przemyslaw Klys

System Architect with over 14 years of experience in the IT field. Skilled, among others, in Active Directory, Microsoft Exchange and Office 365. Profoundly interested in PowerShell. Software geek.

Share
Published by
Przemyslaw Klys

Recent Posts

Upgrade Azure Active Directory Connect fails with unexpected error

Today, I made the decision to upgrade my test environment and update the version of…

1 month ago

Mastering Active Directory Hygiene: Automating Stale Computer Cleanup with CleanupMonster

Have you ever looked at your Active Directory and wondered, "Why do I still have…

2 months ago

Active Directory Replication Summary to your Email or Microsoft Teams

Active Directory replication is a critical process that ensures the consistent and up-to-date state of…

7 months ago

Syncing Global Address List (GAL) to personal contacts and between Office 365 tenants with PowerShell

Hey there! Today, I wanted to introduce you to one of the small but excellent…

11 months ago

Active Directory Health Check using Microsoft Entra Connect Health Service

Active Directory (AD) is crucial in managing identities and resources within an organization. Ensuring its…

1 year ago

Seamless HTML Report Creation: Harness the Power of Markdown with PSWriteHTML PowerShell Module

In today's digital age, the ability to create compelling and informative HTML reports and documents…

1 year ago