Using AD Property Sets

A: AD property sets are groupings of object properties (or attributes). A good example of a property set is "Personal Information," which contains a total of 41 attributes, including a user's address and telephone attributes. Table 1 summarizes all default AD property sets that are predefined in the schema of the Windows 2000 Server and Windows Server 2003 and R2 AD.

Microsoft implemented AD property sets to allow more efficient access control management for multiple object attributes (or properties) in the directory. The grouping of many properties into a property set allows administrators to use one access control entry (ACE) to grant or deny permissions on an AD object for the complete collection of properties at once. Without property sets, administrators would need to apply many separate ACEs for each individual property that's part of a property set collection. . . .