How to change the value of the adminCount attribute in AD?

Question

Active Directory

Hello.
For 2008r2, DC created a built-in group for first line tech support agents. Their task is simple - to arrange the values ​​in the fields of the "User" object, namely, description, room, phone. Through delegation gave them such rights.
But, some users are in protected groups, which is indicated by the attribute adminCount = "1" and you cannot change the information in their fields.
How can this problem be solved? I think there must be some permission in the delegation, but what?

Answer 1

You can remove protection, but the object must not be in protected groups. We make sure that it is not, and:

1. Change the value of the admincount attribute to 0
   
2. We allow inheritance in the security settings of the user object.