Customising AD U&C MMC

[PhilKGH]

I am trying to create a customised MMC to give to my desktop support staff, allowing them the most limited functionality on user accounts. I would like them to be able to read all properties but just to write certain ones, like personal details etc.

Does anyone know of a list anywhere that defines all the property names in the delegation of control screen? I have particular problems in that I can't identify which one relates to the ability to type in the login script name, and various others.

The other issue is that after applying a set of applies/denys, the security tab creates a separate entry in the "Access control settings" tab, for the delegated user, for every property selected, instead of displaying them all within the same line. This makes it tedious when checking things afterwards. Does anyone know if there is a way of preventing it doing this?

Regards,
Phil.

 

[PhilKGH]

I have made some progress on this, in that the one to allow the typing in of a login script is called "write script path". However, this doesn't seem to be available in a Windows 2000 domain (not mixed mode anyway). Is there an extension that can be installed to provide extra functionality such as this?