Delegating Control Over Administrative Groups in Software

Printer EAN / UCC - 13 in Software Delegating Control Over Administrative Groups

Next we ll use the Exchange Administration Delegation Wizard to delegate Exchange administrative permissions to different groups of users for different administrative groups in our organization In particular, we will:

Assign the Exchange Administrator role to the VancouverExAdmins global group for the Vancouver administrative group Assign the Exchange Administrator role to the SeattleExAdmins global group for the Seattle administrative group

Open System Manager and right-click on the Vancouver node within the Administrative Groups container Select Delete Control to start the

13

wizard Note that the permissions previously assigned to the Organization container have been inherited by the Vancouver container Click Add and browse to select the VancouverExAdmins group and assign this group the Exchange Administrator role in the Delegate Control dialog box (see Figure 134) Your wizard screen should now look like Figure 136 Finish the wizard

Figure 136 Assigning the Exchange Administrator role to the VancouverExAdmin global group for the Vancouver administrative group

Now repeat these steps, only this time assign the Exchange Administrator role to the SeattleExAdmins global group for the Seattle administrative group Once you ve completed these steps, test your permissions assignment by logging off and then logging on as a user that belongs to the VancouverExAdmins global group (in my case this is Hannah Parker or hparker@mtitcom) You should find that Hannah can edit Exchange configuration settings for Box14 in Vancouver but cannot edit the configuration of Box16 in Seattle, nor can she modify permissions settings on the Security tab in either administrative group or the Exchange Administration Delegation Wizard Test a user in the SeattleExAdmins group the same way Now we can see what administrative groups, which we covered in 12, are really for!

To create a mailbox, a user needs to be able to create a user in AD Members of the Account Operators group are supposed to have this privilege by default, so let s test this Log on as Administrator, start ADUC, and create a new user called Jason Heart (jheart@mtitcom) in the IT organizational unit Make Jason a member of the Accounting Operators built-in group Now log off and then log on as jheart@mtitcom and see if Jason can use ADUC to create a second user, Susan Olivetti (solivetti@mtitcom) The New Object User wizard lets Jason create the new user but not an associated mailbox for Susan (Figure 137) Therefore, members of Account Operators can create new users but cannot mailbox- or mailenable these users

Log off and then on as Administrator and use the Exchange Administration Delegation Wizard to delegate the Exchange View Only Administrator role to the Account Operators built-in group for the Organization node in System Manager Log off and then on as Jason, start

13

ADUC, right-click on Susan Olivetti in the IT organizational unit, and select Exchange Tasks to run the Exchange Task Wizard and create a mailbox for Susan Also try creating another new mailbox-enabled user from scratch We ve now enabled members of the Account Operators group to create and manage Exchange recipients using ADUC Log off and then on as Administrator, start System Manager, run the Exchange Administration Delegation Wizard for the Organization node, and delegate the exchange View Only Administrator role to the RecipientAdmins global group you created earlier Log off and then on as a user who belongs to the RecipientAdmins group (mine is named Randy Jamieson or rjamieson@mtitcom) and see whether he can use ADUC to create a mailbox-enabled user It won t work Randy doesn t even have the New option on his shortcut menu in ADUC! Log on as Administrator and try adding the RecipientAdmins group to the Account operators group Log on as Randy and try to create a mailbox-enabled user This time it works! This second method is more flexible than the first one, especially in a larger enterprise

Summary

In this chapter we ve looked at how to use Exchange extended permissions and the Exchange Administration Delegation Wizard to grant different Exchange administration roles to different users and groups We ve also tied this in with administrative groups, covered in 12, and seen how we can delegate Exchange administration roles to different users using these administration groups In 14, we ll begin our consideration of Exchange data storage architecture by looking at the concept of storage groups