Name ------Set-ADServerSettings Get-Recipient New-OrganizationRelationship in C#

Printing QR in C# Name ------Set-ADServerSettings Get-Recipient New-OrganizationRelationship

Parameters --------------{ConfigurationDomainController, Confirm, Debug,. {Anr, BookmarkDisplayName, Credential, Debug, {DeliveryReportEnabled, DomainNames, Name}

4

Write-AdminAuditLog Get-MessageTrackingReport Get-Mailbox Search-MessageTrackingReport Set-OrganizationRelationship Get-MessageTrackingLog Get-ExchangeServer Get-DomainController

Message Tracking Message Tracking Message Tracking Message Tracking Message Tracking Message Tracking Message Tracking Message Tracking

{Comment, Confirm, Debug, DomainController, {BypassDelegateChecking, Debug, DetailLevel, {Anr, Arbitration, Archive, Credential, Database, {BypassDelegateChecking, Confirm, Debug, {DeliveryReportEnabled, Identity} {Debug, DomainController, End, ErrorAction, {Debug, Domain, DomainController, ErrorAction, {Credential, Debug, DomainName, ErrorAction,

If you recall the discussion about how the Exchange Management Shell (EMS) and its relationship with RBAC in 3, The Exchange Management Shell, it should now be clear how cmdlets are made available to users and loaded into an EMS session during initialization. In this case, if a user holds the Message Tracking role through membership of a role group, EMS will load the 11 cmdlets and their available parameter set as listed earlier to make them available during the session (you ll see only six cmdlets listed on an Exchange 2010 server). Role entries are named through a combination of the role group name and the cmdlet, so including the asterisk wildcard character in the command instructs Exchange to return all of the cmdlets assigned to the role group. To return details of a specific cmdlet, including the parameters that can be used, we include the cmdlet name:

You can also find the list of roles that a specific cmdlet is assigned to with the GetManagementRole cmdlet. For example, to list all roles that can update mailbox information with the Set-Mailbox cmdlet:

Get-ManagementRole cmdlet 'Set-Mailbox'

4

Role assignments can limit access down to the parameter level for a cmdlet. Exchange uses this capability to restrict users from being able to write to specific data items within a larger set. For example, the default role assignment policy allows users to update their contact details, but not their display name, through Exchange Control Panel (ECP). You can interrogate Exchange to discover the role assignments that underpin this capability by looking for the assignments that control the ability to use the Set-User cmdlet to update their mobile phone number (one of the data items permitted by the default role assignment policy) as follows:

Get-ManagementRole -Cmdlet Set-User -CmdletParametersMobilePhone| Get-ManagementRoleAssignment -GetEffectiveUsers -Delegating $False | Where-Object {$_.Effectiveusername -ne "All Group Members"} | Format-Table Role, RoleAssigneeName, EffectiveUserName

If we explore this code, we see that it does the following:

Look for all roles that permit access to the MobilePhone property through Set-User. Pipe the roles to Get-ManagementRoleAssignment to return a list of users who have been delegated access through a role assignment (if the Delegating parameter is set to $True, you will see a list of users who can delegate access to others). Filter the list to remove All Group Members because we only want to see individual users. Output the role, assignee name, and user name.

The output:

Role ---Mail Recipients Mail Recipients Mail Recipients Mail Recipients Mail Recipients Mail Recipients User Options User Options MyContactInformation RoleAssigneeName ---------------Organization Management Organization Management Help Desk Level 2 Support EMEA Help Desk EMEA Help Desk APJ Help Desk Organization Management Organization Management Default Role Assignment Policy EffectiveUserName ----------Administrator Halstead, Dean Ruth, Andy Pelton, David Smith, John Akers, Kim Administrator Redmond, Tony All Policy Assignees

RBAC currently allows restrictions to be placed on cmdlets that write data (cmdlets beginning with New- and Set-) . It does not support restrictions on the Get- cmdlets that allow users to retrieve the properties of an object . This means that restricted users can read all of the data for an object, even though they might not be able to update some or even all of the attributes .

!