How to give a user access to just 2 fields in a user account properties

Question

Is it possible to create a user that has basic access rights in Active Directory but give it access to just the users name and telephone number of every user in Active Directory?  We have a Windows 2003 AD level at the moment.
Thanks.

Answer 1

Sure, by default a user you create in Active Directory is going to be apart of Domain Users.  This user will be an Authenticated User and will have Read permissions over all other users in AD, meaning they can see all other users information.
If you want you can delegate control to a user or group and limit or expand what the user can do.  For instance you can right-click the name of your domain in Active Directory Users and Computers and click Delegate Control then click Next.  Click
add to add a user or test user, then click Next. Click the Create a custom task to delegate then click Next, select Only the following objects in the folder, then select account objects and click Next. Click Property-specific and there you'll find things like
Read displayName.  Check Read displayName and Click next then click Finish.  So you've delegated that to that user or group. 
How to Delegate Basic Server Administration To Junior Administrators. 
http://support.microsoft.com/kb/555986
Best Practices for Delegating Active Directory Administration 
http://technet.microsoft.com/en-us/library/cc773318%28v=ws.10%29.aspx
If it answered your question, remember to “Mark as Answer”.
If you found this post helpful, please “Vote as Helpful”.
Postings are provided “AS IS” with no warranties, and confers no rights.
Active Directory: Ultimate Reading Collection