Exchange 2010 PowerShell Access and Commands for Departmental IT Staff. (CatNet OU Admins)

Transcription

1 Exchange 2010 PowerShell Access and Commands for Departmental IT Staff (CatNet OU Admins)

2 Table of Contents UAConnect and Role Based Access Control... 2 Role Groups and how they are assigned... 2 Custom Management Roles for Departmental IT... 3 Available Cmdlets (organized by role)... 4 OUAdmin NetID Mail Recipients cmdlets... 4 OUAdmin NetID Mail Recipient Creation cmdlets... 4 OUAdmin NetID Active Directory Permissions... 4 OUAdmin Dept Mail Recipients... 5 OUAdmin Recipient Policies cmdlets... 6 OUAdmin Message Tracking cmdlets... 6 OUAdmin Monitoring cmdlets... 6 OUAdmin Dept Mail Recipient Creation cmdlets... 6 OUAdmin Dept Mailbox Search cmdlets... 6 OUAdmin Dept Distribution Groups cmdlets... 7 OUAdmin Dept Mailbox Import Export cmdlets... 7 OUAdmin Dept Retention Management cmdlets... 7 OUAdmin Dept View-Only Audit Logs cmdlets... 7 OUAdmin Role Management cmdlets... 7 OUAdmin Security Group Creation and Membership cmdlets... 8 OUAdmin Support Diagnostics cmdlets... 8 OUAdmin Dept Active Directory Permissions cmdlets... 8 Page 1

3 UAConnect and Role Based Access Control Exchange 2010 introduced a new permissions model called Role Based Access Control (RBAC). The flexible and granular nature of this model allows UITS to delegate very specific actions to OU Admins; providing full control of Exchange objects within the delegated OU structure and providing sufficient control over NetID based accounts to allow Departmental IT staff to support the users for which they are responsible. This document describes the custom management roles created for OU Admins and provides a full listing of all the PowerShell cmdlets OU Admins have access to. *For more information on RBAC see: Understanding Role Based Access Control Role Groups and how they are assigned Role Groups are collections of roles that can be bound to a specific scope (i.e. an OU or a group). Assigning a role group to a user (or group) provides the user (or group members) with access to all of the cmdlets contained within the role group. In UAConnect, each group of OU Admins has at least two role groups assigned. The role groups are configured as follows: Role Group Name: <DEPT>-NetID-Admin (i.e. UITS-NetID-Admin) Assigned Roles: OUAdmin NetID Mail Recipients OUAdmin Monitoring OUAdmin NetID Mail Recipient Creation OUAdmin Role Management OUAdmin Recipient Policies OUAdmin Message Tracking OUAdmin NetID Active Directory Permissions Role Group Name: <DEPT>-OUAdmin (i.e. UITS-OUAdmin) Assigned Roles: OUAdmin Dept Mail Recipients OUAdmin Dept Retention Management OUAdmin Recipient Policies OUAdmin Dept View-Only Audit Logs OUAdmin Message Tracking OUAdmin Role Management OUAdmin Monitoring OUAdmin Dept Mail Recipient Creation OUAdmin Security Group Creation and Membership OUAdmin Dept Mailbox Search OUAdmin Dept Distribution Groups OUAdmin Dept Active Directory Permissions OUAdmin Dept Mailbox Import Export Page 2

4 Each role group has a specific scope within which the OU Admins can act. The <DEPT>-NetID-Admin role group is assigned a custom write scope labeled <DEPT>- NetIDRecipients which is tied to a group of the same name. The group contains a roll-up of all the payroll groups the OU Admins are responsible for supporting. While management of the <DEPT>- NetIDRecipients must be done manually by the Enterprise Admins, the payroll groups are managed automatically based on EDS data. The <DEPT>-OUAdmin role group scope is set to the delegated OU for the department. The cmdlets available to the role group can be applied to objects within the delegated OU and all child OUs. Custom Management Roles for Departmental IT OUAdmin NetID Mail Recipients (parent "Mail Recipients"): This role primarily provides the ability to view information regarding mailboxes and mailusers, but it also allows for some parameters such as mailbox permissions and send on behalf of rights to be set OUAdmin NetID Mail Recipient Creation (parent Mail Recipient Creation ): This role allows setting mailbox folder permissions. OUAdmin NetID Active Directory Permissions (parent Active Directory Permissions ): This role permits setting send as rights on mailboxes. OUAdmin Dept Mail Recipients (parent "Mail Recipients"): This role provides near full control of mailboxes and other mail recipients. OUAdmin Recipient Policies (parent "Recipient Policies"): This role allows viewing a subset of the recipient policies. OUAdmin Message Tracking (parent "Message Tracking"): This role provides access to view and search the message tracking logs and reports. OUAdmin Monitoring (parent "Monitoring"): This role allows access to test various connectivity options when troubleshooting mailbox issues. OUAdmin Dept Mail Recipient Creation (parent "Mail Recipient Creation"): This role provides the ability to create and delete mail recipients. OUAdmin Dept Mailbox Search (parent "Mailbox Search"): This role allows for searching mailboxes. OUAdmin Dept Distribution Groups (parent "Distribution Groups"): This role allows creation, manipulation and deletion of distribution groups; standard and dynamic. OUAdmin Dept Mailbox Import Export (parent "Mailbox Import Export"): This role permits mailbox exports and imports. OUAdmin Dept Retention Management (parent "Retention Management"): This role provides access to view and set junk configuration. OUAdmin Dept View-Only Audit Logs (parent "View-Only Audit Logs"): This role allows for searching mailbox audit logs. OUAdmin Role Management (parent "Role Management"): This role allows viewing of the available management roles and scopes and how they are applied. OUAdmin Security Group Creation and Membership (parent "Security Group Creation and Membership"): This role allows manipulation of group membership. Page 3

5 OUAdmin Support Diagnostics (parent "Support Diagnostics"): This role provides access to calendar and mailbox diagnostic logs. OUAdmin Dept Active Directory Permissions (parent "Active Directory Permissions"): This role permits viewing and setting Active Directory permissions. Available Cmdlets (organized by role) OUAdmin NetID Mail Recipients cmdlets Add-MailboxFolderPermission Permission Get-ActiveSyncDevice RegionalConfiguration Get-ActiveSyncDeviceStatistics SpellingConfiguration Get-ActiveSyncMailboxPolicy Get-mailboxStatistics Get-AddressBookPolicy Get-MailUser Get-CalendarNotification Get-OfflineAddressBook Get-CalendarProcessing Get-InboxRule Get-OwaMailboxPolicy Get-LogonStatistics Get-PhysicalAvailabilityReport AutoReplyConfiguration Get-ServiceAvailabilityReport CalendarConfiguration Get-ServiceStatus CalendarFolder Get-TextMessagingAccount FolderPermission FolderStatistics PrincipalNamesSuffix Junk Configuration Remov boxFolderPermission MessageConfiguration Test-MAPIConnectivity Cmdlets with customized parameter availability Set-Mailbox -Parameters Identity, Confirm, GrantSendOnBehalfTo, WhatIf Set-MailUser -Parameters Identity, Confirm, GrantSendonBehalfTo, UseMapiRichTextFormat, UsePreferMessageFormat, WhatIf ADD-MailboxPermission -Parameters Identity, AccessRights, Confirm, User, AutoMapping, InheritanceType, WhatIf Remov boxPermission -Parameters Identity, AccessRights, Confirm, User, InheritanceType, WhatIf OUAdmin NetID Mail Recipient Creation cmdlets Set-MailboxFolderPermission OUAdmin NetID Active Directory Permissions Add-ADPermission Remove-ADPermission Get-ADPermission Page 4

6 Page 5 OUAdmin Dept Mail Recipients Add-MailboxFolderPermission Add-MailboxPermission Clear-ActiveSyncDevice Connect-Mailbox Disable-InboxRule Disabl box Disabl Contact Disabl User Disable-Service Channel Enable-InboxRule Enabl box Enabl Contact Enabl User Enable-Service Channel Get-ActiveSyncDevice Get-ActiveSyncDeviceStatistics Get-ActiveSyncMailboxPolicy Get-AddressBookPolicy Get-CalendarNotification Get-CalendarProcessing Get-Contact Get-InboxRule Get-LogonStatistics AutoReplyConfiguration CalendarConfiguration CalendarFolder FolderPermission FolderStatistics Junk Configuration MessageConfiguration Permission RegionalConfiguration SpellingConfiguration Get-mailboxStatistics Get-MailContact Get-MailUser Get-OfflineAddressBook Get-OwaMailboxPolicy Get-PhysicalAvailabilityReport Get-ServiceAvailabilityReport Get-ServiceStatus Get-TextMessagingAccount PrincipalNamesSuffix New-InboxRule New-MailboxRepairRequest Remove-ActiveSyncDevice Remove-InboxRule Remov boxFolderPermission Remov boxPermission Set-CalendarProcessing Set-Contact Set-InboxRule Set-Mailbox Set-MailboxAutoReplyConfiguration Set-MailboxCalendarConfiguration Set-MailboxCalendarFolder Set-MailboxJunk Configuration Set-MailboxMessageConfiguration Set-MailboxRegionalConfiguration Set-MailboxSpellingConfiguration Set-MailContact Set-MailUser Set-User Test-MAPIConnectivity

7 OUAdmin Recipient Policies cmdlets Get-ActiveSyncMailboxPolicy Get-ThrottlingPolicyAssociation Get-OwaMailboxPolicy OUAdmin Message Tracking cmdlets Get-MessageTrackingLog Resum boxExportRequest Get-MessageTrackingReport Search-MessageTrackingReport OUAdmin Monitoring cmdlets get-availabilityreportoutage test-mapiconnectivity get-clientaccessserver test-outlookconnectivity get-mailbox test-outlookwebservices get-recipient test-owaconnectivity test-activesyncconnectivity test-popconnectivity test-calendarconnectivity test-powershellconnectivity test-ecpconnectivity test-smtpconnectivity test-imapconnectivity test-webservicesconnectivity test-mailflow OUAdmin Dept Mail Recipient Creation cmdlets Get-ActiveSyncMailboxPolicy Get-AddressBookPolicy New-Mailbox New-MailContact Get-MailContact New-MailUser Get-MailUser Remov box Remov Contact Remov User Get-SharingPolicy Set-MailboxFolderPermission Get-ThrottlingPolicyAssociation OUAdmin Dept Mailbox Search cmdlets New-MailboxSearch ExportRequest Remov boxExportRequest ExportRequestStatistics Remov boxSearch Search Search-Mailbox Set-MailboxExportRequest New-MailboxExportRequest Set-MailboxSearch Page 6

8 Start-MailboxSearch Suspend-MailboxExportRequest Stop-MailboxSearch OUAdmin Dept Distribution Groups cmdlets Add-DistributionGroupMember Disable-DistributionGroup New-DistributionGroup Enable-DistributionGroup New-DynamicDistributionGroup Get-DistributionGroup Remove-DistributionGroup Get-DistributionGroupMember Remove-DistributionGroupMember Get-DynamicDistributionGroup Remove-DynamicDistributionGroup Get-Group Set-DistributionGroup Set-DynamicDistributionGroup Get-MailUser Set-Group Set-OrganizationConfig Update-DistributionGroupMember Get-ResourceConfig OUAdmin Dept Mailbox Import Export cmdlets Export-Mailbox Remov boxImportRequest Resum boxExportRequest ExportRequest Resum boxImportRequest ExportRequestStatistics Search-Mailbox ImportRequest Set-ADServerSettings ImportRequestStatistics Set-MailboxExportRequest Import-Mailbox Set-MailboxImportRequest New-MailboxExportRequest Suspend-MailboxExportRequest New-MailboxImportRequest Suspend-MailboxImportRequest Remov boxExportRequest OUAdmin Dept Retention Management cmdlets Junk Configuration Set-MailboxJunk Configuration OUAdmin Dept View-Only Audit Logs cmdlets new-mailboxauditlogsearch search-mailboxauditlog OUAdmin Role Management cmdlets Get-DistributionGroup Get-DistributionGroupMember Get-ManagementRole Get-Group Get-ManagementRoleAssignment Page 7

9 Get-ManagementRoleEntry Get-RoleGroup Get-ManagementScope Get-RoleGroupMember Get-SecurityPrincipal Get-RoleAssignmentPolicy OUAdmin Security Group Creation and Membership cmdlets Update-DistributionGroupMember Set-Group Set-DistributionGroup Set-ADServerSettings Get-DistributionGroupMember Remove-DistributionGroupMember Get-DistributionGroup Remove-DistributionGroup Add-DistributionGroupMember New-DistributionGroup OUAdmin Support Diagnostics cmdlets Get-CalendarDiagnosticLog Export-MailboxDiagnosticLogs OUAdmin Dept Active Directory Permissions cmdlets Remove-ADPermission Get-Group Get-ADPermission Get-SecurityPrincipal Add-ADPermission Get-RoleGroup Page 8