Suppose User X logs into SharePoint and there is webpart to access and change his AD properties, I want to know:

  1. what permission should be there for him to be able to query his AD properties.

  2. what permissions should be there to modify his AD properties.?

  3. In an application page OR a webpart, under which account credentials does the .NET code run? Is it the current user or is it the application pool account? The reason I am asking this is that accordingly either all SP users or apppoolaccount needs to be given permissions (if applicable) to access/modify AD properties.

  4. Is LDAP the only way to access/modify AD via .NET code?

Please note that the access/modify is to be done programatically via code and not using user profile app or sync.


This is a little odd, but I'll try to answer the way I interpret your question. I'm guessing you want to change Active Directory user properties using SharePoint. In order to do this, you should have a User Profile Service up and running.

The user properties you want to be able to change should have the synchronization direction set to Export. This means that the user can update AD from SharePoint. This is useful for mobile phone number and related persons which is better maintained at the user.

The account running the user profile service needs two permissions in Active Directory:

  • Thanks for taking time and writing this, but I am looking for a programatic approach. Sorry, updated my question with this. – variable Jul 24 '14 at 5:46
  • @variable No worries. I think you are in for a real challenge updating Active Directory permissions from SharePoint using custom code. Good Luck! – Benny Skogberg Jul 24 '14 at 6:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.