To create an access template to deny modification of the thumbnailPhoto attribute, follow the steps below:
- Within the Active Roles console expand Access Templates
- Select or create an appropriate access template container
- Right click on the container
- Select New | Access Template
- Give it an appropriate name
- Click Next
- Click Add
- Toggle radio button Only the following classes:
- Place a check mark beside User
- Click Next
- Toggle Object property access
- Check off Write properties
- Check off Deny permission to the right
- Click Next
- Toggle The following properties
- Check off thumbnailPhoto
- Click Finish
- Click Next
- Click Finish
Once complete just link the access template to an object