Being responsible for Active Directory you're often tasked with fairly simple task of delegating permissions for user and groups. After doing it multiple times you know how to do it, but then you're told to delegate only one attribute physicalDeliveryOfficeName and things get complicated.
Normally delegating attributes in Active Directory is simple walk in a park.
You open up Active Directory Users and Computers
Right click on click on root of the domain or the object you want to delegate permissions on choose Delegate Control…
Follow Delegation of Control Wizard
Select User or Groups to delegate permissions to (obviously choose Groups)
Choose Create a custom task to delegate
Choose Only the following objects in the folder, and select User objects
And then, uncheck General, choose Property-Specific and find your precious property such as physicalDeliveryOfficeName that you were looking for on the list.
The only problem… it's not on the list. So you cancel, and go for the more direct approach.. modifying security properties directly.
You choose Properties, go to Security tab and press Advanced.
Then you choose Add permission, you choose your principal group, you choose Type to Allow, Applies to: Descendant User objects… finally you uncheck not needed permissions, and then you find there's no such field as physicalDeliveryOfficeName on that list!
As bad as it sounds I was really stomped. Either I am blind or something is seriously missing. It turns out it is missing and unless you enable it it's gonna stay invisible. The solution is quite simple:
Close all instances of Active Directory Users and Computers
Open Windows Explorer and go to C:\Windows\System32 and find dssec.dat file
Make yourself a copy of that file in case things get ugly. The file holds settings for each value for that is supposed to be filtered out of delegation/security tabs.
Find [user] section (or any section you want that property to be visible at and change physicalDeliveryOfficeName=7 to physicalDeliveryOfficeName=0.
Now open up Active Directory Users and Computers and it should be there… although not in the form you expected it. The property is called Office Location.
And if you're wondering now if it was there all along.. well I did wonder myself so I've checked on different AD controller… and as you can see below it's not there.
After you edit the Dssec.dat file, you must quit and restart Active Directory Users and Computers to see the properties that are no longer filtered. The file is also machine specific so changing it on one machine doesn't update all others. It's up to you whether you want it visible everywhere or not.