question

Hello

Please note that If the attribute you want to secure is not in the list, you will need to modify the %SystemRoot%\system32\dssec.dat file on the computer running the ACL Editor.

You must edit the dssec.dat file on your workstation, not on the DC. When determining which property permissions to display in a user's ACL account or any other AD object, Win2K looks at the dssec.dat file on the workstation on which you're logged on, not the DC.

--If the reply is helpful, please Upvote and Accept as answer--

I'm logged on to the DC. There are attributes of user accounts I cannot see, therefore need to edit dssec.dat. I need to set those attributes for delegation purpose. If I edit dssec.dat on the DC im logged in and do the delegation with those attributes, does the changes in delegation replicate to other DCs?