How To Give Read Access to Confidential Attribute To Non-Admin User

hello,

trying give service account user access confidential attribute (in our case, made drink attribute confidential) on our windows 2008 r2 ad instance. not want give user admin rights view it. technet articles i've found on subject suggest using dsacls command accomplish this. tried on our development environment, , worked!  then tried on production environment , didn't work. did not see difference between output when ran command on dev vs. production. here's output :

==============================

c:\windows\system32>dsacls "cn=admin,dc=example,dc=com" /g domain\user:ca;drink

.....

allow domain\user                special access drink
                                      control access

.....

command completed successfully

c:\windows\system32>

==============================

there's difference between production , dev environments. wasn't 1 set them not sure are. don't expect know either. looking for, however, list of things check causing user not able read drink attribute. appreciate help. let me know if need more information.

thanks!

i kept reading user needs read property permission (although didn't need add in our dev environment). able give rights, rights didn't translate user being able view drink attribute. permissions stand @ :

allow domain\user                special access drink
                                      control access
allow domain\user                special access drink
                                      read property

Windows Server  >  Directory Services