/ 中存储网

Exchange 2010分支机构权限委派如何设置

2014-08-28 22:57:12 来源:中存储网

案例:要求子域管理员只能在子域的邮件系统中具有维护通讯组成员身份(子域范围内)的权利,即只能修改通讯组的成员关系,不能创建删除通讯组,不能有对整个组织的通讯组成员有相应的权限。

方法:可以通过RBAC来进行权限的设定,具体设置步骤如下:

1. 由于默认的Role权限比较大,需要建立新的Role以便得到相应的权限:

New-ManagementRole -Parent "Distribution Groups" -Name "Edit Distribution Group"

New-ManagementRole -Parent "Security Group Creation and Membership" -Name "Edit Security Group"

2. 根据要求对默认的role权限进行客制化删除对通讯组的添加删除功能:

Get-ManagementRoleEntry " Edit Distribution Group *Remove*" | Remove-ManagementRoleEntry

Get-ManagementRoleEntry " Edit Distribution Group *New*" | Remove-ManagementRoleEntry

Get-ManagementRoleEntry " Edit Security Group Remove-distributiongroup " | Remove-ManagementRoleEntry

Get-ManagementRoleEntry " Edit Security Group New-distributiongroup" | Remove-ManagementRoleEntry

3. 创建 recipient filter scope

New-ManagementScope -Name  "Scope of users"  -RecipientRestrictionFilter { EmailAddresses -Like "*a.local*" }  -RecipientRoot "a.local"

4. 创建一个 Role Group

New-RoleGroup -Name " Edit Distribution Role Group" -Roles "Edit Distribution Group", "Edit Security Group" -CustomRecipientWriteScope "Scope of users" 

5. 添加授权的用户到 role group

Add-RoleGroupMember -Identity "DGRoleGroup" -Member "user1" "group1" 

之后user1和group1就有权限可以通过Exchange management shell 和ECP来编辑该子域的通讯组,但不能添加和删除通讯组。