We have a challenge in our enterprise, where we have at least a few different storage locations for employee information. We are trying to get this all consolidated as much as possible so there is one place to go and look up / edit employee information such as name, address and phone number.

Since 90+% of employees have active directory accounts, we are thinking AD is a good place to make the master source of information - to pull from there / make edits there.

The rest will be updated / pulled from a second HR system (the HR system is limited however, and not user friendly for MIS or other non HR staff to go in and out of and make edits on a regular basis). These are employees that are short term and most likely not worth the effort of constantly editing by MIS.

So, I am looking for suggestions on how to allow certain key users (specific managers or HR staff for example) to be given access to some sort of utility or interface to edit active directory users (or possibly even add them if possible).

However, I of course do not want to allow any non MIS staff to be able to edit the access information such as group memberships. They should only be able to edit personal information such as name, address, phones and similar.

One possibility I am looking at is SpiceWorks - I already use it, and synchronize with AD. I know it has an ability to write changes back to AD, so maybe that will work. Anyone else use SpiceWorks, or any other utility to do this (or have other suggestions)?