If you ran into Access Denied errors as you attempted to customize the context menu, or if you ever run into such errors, it’s because the DisplaySpecifiers container is in the Configuration container, which is, by default, delegated to Enterprise Admins.

A number of clients freak out if we suggest delegating any part of Active Directory outside of the domain partition. But it’s just a database, and if lower level administrators need, for valid business reasons, to be able to modify another part of the database, such as DisplaySpecifiers, you should delegate them that capability!

This is one exception to the rule of delegation. The rule is delegate at the container level.

However, with display specifiers, we suggest you to delegate each display specifier that you want a group to be able to modify. If, by some chance, you want a group to be able to change display specifiers for all objects, you should delegate the language container, or even the DisplaySpecifiers container.

But we expect you’ll need to delegate only the user, computer, group, and organizational unit display specifiers for one or two languages. Be granular. Then follow these steps to delegate:

1. Open the display specifier (for example, user-Display) within the appropriate language (such as CN=409 for English) in ADSI Edit.

2. Click the Security tab.

3. Click Add,

And select the group to which you want to delegate the ability to modify displayspecifiers. we suggest having a capability management group named something like AD_DisplaySpecifiers_Modify.

4. Select the Allow Write check box and then click OK to save your changes.