Ilse
Is there any way to delegate permissions at a site level to one Role Group who then have permissions as a whole over everything within a site? Or do we need to look to creating custom groups for all areas within a site (Server Admin, Voice Admin, User Admin, etc.) and obviously the associated USGs?
Thanks
Paul
Paul, you could create a new Universal Security Group, then create a new role, and use the CsAdministrator role as a template, and scope it to a site. Thereby members of that group will have csAdministrator rights on all objects in that site! A CsAdministrator can perform all administrative tasks and modify all settings, including creating roles and assigning users to roles. They can also expand a deployment by adding new sites, pools, and services.
For a detailed description of the built-in roles, here's a link to the TechNet article on it:
technet.microsoft.com/.../gg425917.aspx
Ilse
Ilse
Further question on RBAC scoping. As we cannot delegate with the CSAdminstator role, we will need to look to performing delegations at a site and domain level.
For user administration - how does this work for delegation for management for child domains? Can I simply use the -UserScopes and use the DN of the domain and not specify an OU? Or should we still restrict this at site level - and if so how will it know the users to manage?
Basically we need to delegate management of users to child domains and server administration at a site level for sure. Or can all be done to site level?
thanks
Paul
Hello Ilse,
How can I remove cmdlets ? There is nothing written in Your artcile, just the last sentence : "At this moment, it is not possible to remove cmdlets, and/or parameters when creating a custom role in Lync.". Ok WHEN its then possible to remove / add cmdlets ?
Thanks and bye,
André
As much I love RBAC, I think RBAC for Lync is still in its infancy. Delegating CSAdministrator for a site is just not possible. You delegate and Lync will glad accept the command. But the administrator will not be able to do anything. I.e create user based policies. I have a lync deployment spanning different countries and I found that bulk of what I need each country to do for themselves is not possible. Only server admins allows this.
