What permission is required to be able to access and modify AD user properties?

Question

Suppose User X logs into SharePoint and there is webpart to access and change his AD properties, I want to know:

1. what permission should be there for him to be able to query his AD properties.

2. what permissions should be there to modify his AD properties.?

3. In an application page OR a webpart, under which account credentials does the .NET code run? Is it the current user or is it the application pool account? The reason I am asking this is that accordingly either all SP users or apppoolaccount needs to be given permissions (if applicable) to access/modify AD properties.

4. Is LDAP the only way to access/modify AD via .NET code?

Please note that the access/modify is to be done programatically via code and not using user profile app or sync.

Answer 1

This is a little odd, but I'll try to answer the way I interpret your question. I'm guessing you want to change Active Directory user properties using SharePoint. In order to do this, you should have a User Profile Service up and running.

The user properties you want to be able to change should have the synchronization direction set to Export. This means that the user can update AD from SharePoint. This is useful for mobile phone number and related persons which is better maintained at the user.

The account running the user profile service needs two permissions in Active Directory:

• Replicate Directory Changes

• Create Child Objects and Write permission