Ilse Van Criekinge's Weblog

Addicted to Microsoft Unified Communications

Exchange 2010: Can you scope permissions to more than one OU?

Exchange 2010: Can you scope permissions to more than one OU?

  • Comments 3
  • Likes

About a month ago I got the following mail:

Hi Ilse I know you had a RBAC Session at Teched. We tried to scope to multiple OU's as described in this article without any success. http://technet.microsoft.com/en-us/library/dd638181(EXCHG.149).aspx RecipientOrganizationalUnitScope use the syntax: domain /OU 1/OU 2/OU N (where N is the designation of each of the specified OUs). Unfortunately we can't find a real example. Have you ever tried this parameter with multiple OU's Thanks in advance Fabian

Not sure why it wouldn’t work as stated in the TechNet Article, it was definitely an interesting question to check out.

Step 1. Setting the scene…

In  my demo environment I have a few Organizational Units, as can be seen in the print screen here:

IVC-0777

The goal would be to create a new group “Studio & Zaventem Admins”, and hand that group the right to manage the mail recipients in the Organizational Units Zaventem, and Studio:

IVC-0781

IVC-0782

Step 2. Follow the steps defined in the mentioned TechNet article

First try, create a new rolegroup, called Studio Admins, that will get the role of Mail Recipients, and will be able to manage a recipients located in the OU Studio, using the EMS line:

New-RoleGroup –Name “Studio Admins” –Roles “Mail Recipients” –RecipientOrganizationalUnitScope studio

And this one worked like a charm:

IVC-0779

So now time to follow what’s specified in the TechNet article:

image

And enter the following line using the wonderful EMS:

New-RoleGroup –Name “Studio Admins” –Roles “Mail Recipients” –RecipientOrganizationalUnitScope studio,zaventem

But unfortunately, no go…

IVC-0780

Using the Exchange Control Panel, no go either….

IVC-0795

IVC-0796

Question =

Does this mean it is impossible to scope a management role to more than one Organizational Unit?

Answer =

No Smile

Question =

How?

Answer =

Using nested OU’s…or using the power of RecipientFilters…(thank you Bharat Suneja for pointing this out)

Since I’m not using nested OU’s, I have to turn to RecipientFilters…

Step 3. Create a Custom Management Scope

Time to create a custom management scope, which includes the two Organizational Units, by using the RecipientRestrictionFilter.

Problem is that OrganizationalUnit is not in the list of filterable properties, all these properties are listed here:

http://technet.microsoft.com/en-us/library/bb738155(EXCHG.80).aspx

But, it is possible to use the DistinguishedName, which includes the Organization Unit:

image

So using the following RecipientRestrictionFilter will cover the two Organization Units in my environment:

New-ManagementScope –Name “Studio & Zaventem Admins” –RecipientRestrictionFilter { (DistinguishedName –Like “*,OU=Studio,DC=Lync,DC=local”) –OR (DistinguishedName –Like “*,OU=Zaventem,DC=Lync,DC=local”) }

IVC-0784

And then creating the new role group, using the previous New-RoleGroup cmdlet, and adding the paramter CustomRecipientWriteScope!

New-RoleGroup –Name “Studio & Zaventem Admins” –Roles “Mail Recipients” –CustomRecipientWriteScope “Studio & Zaventem Admins”

IVC-0785

IVC-0786

Step 4. Time to Test

Adding user Studio1 to the newly created Universal Security Group:

IVC-0787

Studio1is able to make changes to a mail recipient in OU Zaventem:

IVC-0790

and OU Studio:

IVC-0792

But not to a user in any other OU:

IVC-0791

 

IVC-0793

Mission accomplished… RBAC really is: You Decide Who can do What on Which Objects in Your Exchange Environment!

Ilse

Comments
  • Is this available in all versions of Exchange 2010? I have SP1 installed and the filter creation failed. Does this require SP2?

  • This doesn't work in SP3 either.  I'm fairly certain they did away with this.  

  • Please Update all Code Samples with working Charsets,i've spenidng an hour in working with your code sample "new-ManagementScope ..." doesnt' work. Result = The dashes are not compatible with ps.

    Soulution = Copy Code into notepad and transcripe it.

    @Cody,@Jnaranjo: Hopefully this helps others

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment