I wrote a program to access Active Directory (AD) user accounts and modify account attributes such as title, department, and company. But when I run the program, AD denies access to the user accounts. What am I doing wrong?
Access to objects in AD is governed by permissions, just like access to files on a file server is. If, for instance, your human resources (HR) staff members will be running your program, their accounts must have Write permission to the user account properties you mentioned or Write all properties permission on the user account objects. On file servers, you don't typically set permissions on individual files; instead, you configure permissions at the folder level. Likewise in AD, the best way to configure permissions is to select an appropriate organizational unit (OU) and set permissions as desired for the type of object you need to control access to—in this case, a user account. Figure 1 shows the ACL of the domain root and shows that the HRStaff group has Write access to the Company and Department properties of User objects. Because the permissions are defined at the root of the domain, HRStaff members will inherit Write access to the specified properties on all user accounts in the domain.
—Randy Franklin Smith