what function does the “write personal” in active directory under the security tab do?
http://support.microsoft.com/kb/292304/en-us By default, you can change certain personal information on your user account, such as, your telephone number and address. Some administrators, however, may want to disable such permissions so that you cannot change your personal information. If you apply “Deny” to the parent organizational unit for the Write Personal Properties permission, you may not succeed because a user account object has explicit permissions assigned to the object when the object is created. The user account is cloned from the user class that is specified in the schema and the Security permissions assigned to this user class become the default Security permissions of the user account object. These permissions include the right to change personal details, and therefore, to override the permissions that are set by the parent organizational unit. To prevent your personal information from being change
