Exchange 2010 - Role Based Access Control

[LEFT][CODE]http://muc-ug.org.in/index.php/articles/exchange-2010/115-exchange-2010-role-based-access-control.html[/CODE]


In Exchange 2010, Microsoft has introduced Role Based Access Control feature. This feature is used to assign a accurate permission to the specialist user or Administrator Unlike Exchange 2007 permissions. [B]Note: [/B]Please Check Reference section for more information’s about the Exchange Server 2010 Permissions.
[B]Terms Used

[/B]


[LIST][*][B]Management Role Group[/B]: Role group is an Universal Security Group which is used to holds the specialist users or administrators. We can assign the appropriate rights (Management Roles) to manage the scope users or groups. There are number of Build-in role groups are available Example: Organization Management, Recipient Management, etc…
[LIST][*]Role Holders – Normal Mailboxes that are members of Management role group[*]Role Group Delegation – We can delegate rights to users to manage this Role Group. This includes Add or Remove members, Configuration Change, etc. This can be achieved through ManagedBy property.[*]Linked Role Groups – This type of Groups is used to store the Trusted Foreign forest[/LIST]
[*][B]Management Roles[/B]: Management Roles are group of cmdlets (it will provide access to view or modify the configuration of Exchange 2010 components), there are Custom Management Roles as well as build-in Management roles are available in Exchange Server 2010 (Built-in management roles Ex: Active Directory Permissions Role, Databases Role, Audit Logs Role, etc …)
Example: Active Directory Permissions Role, Address Lists Role, ApplicationImpersonation Role, Audit Logs Role, cmdlet Extension Agents Role, Database Availability Groups Role, Database Copies Role, Databases Role[*][B]Management Role Scopes[/B]: Influence of a management role where the Management Roles are applied. Role Holder can manage the objects within the scope. There are two types of Management Scopes are available Regular and Exclusive.[*][B]Role assignment policies[/B]: This is also an Management Roles, which enable the users to manage their own mailbox.(Example: Phone Number Update rights, Address details Update Rights, etc)[/LIST]
[B]RBAC Overview

[/B]

The below diagram show you the RBAC overview
[CENTER][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/1_thumb.png[/IMG][/CENTER]
[B]Advantages[/B]


[LIST][*]We can provide a accurate permission to the target user ID[*]Easy to provide appropriate rights to user to manage their own mailbox[*]Possible to provide a specific set of permissions to the single user with the help of [B]Direct User Role Assignment[/B][*]Easy Role assignment management by creating multiple Role group[*]Easy to provide the permission to manage the Distribution list and mailbox management[/LIST]
[B]Possible ways to assign RBAC[/B]

They are three ways of assigning permissions to users, Administrators or an Management Role Groups. The types are mentioned below

[LIST][*]Management role groups[*]Management role assignment policies[*]Direct user role assignment[/LIST]
[B]Implementation

[/B]

[B]Scenario – Assigning RBAC through Management role groups[/B]

We are going to implement Role Based Access Control Feature in an Exchange Server 2010 Environment, Here is the test Scenario

[LIST][*]Need to create New Role Group – [B]Helpdesk India [/B][*]Need to add the members - [B]Supportuser1[/B],[B] Supportuser2[/B][*]Need to Add the Role Group Management user – [B]Manager[/B], [B]Administrator[/B][*]Target scope Organizational Unit – [B]India Users [/B]and the(Indiauser1 and Indiauser2 are members of this India Users OU)[*]Roles we are going to assign is – [B]Move Mailboxes[/B][/LIST]
[B]Constraints[/B]

Before start the implementation we need to analyze the requirements and constraints as well.

[LIST][*]Since RBAC cannot be implement through Exchange Management Console. We need to use Poweshell commands.[*]We can create multiple Role group, and also it is possible that a single user can be part of multiple Role Group.[*]If it is an existing group then it should be an Universal Security Group, In our scenario it is an new group so we need to create new Universal security group[/LIST]
[B]Step :1 – Scope Creation[/B]

First we need to create a Scope, as per our scenario we need to create a scope for OU: [B]India Users[/B]
To create the Scope Go to [B]Start[/B] | [B]All Programs[/B] | [B]Microsoft Exchange Server 2010[/B] | [B]Microsoft Management Shell [/B]| Run [B]New-ManagementScope -Name "India Users Mailboxes" -RecipientRestrictionFilter { RecipientType -eq 'usermailbox' } -RecipientRoot "veera.com/India Users"[/B]
[B]Note[/B]: The following are Variables, this will vary according to your environment

[LIST][*]veera.com - Domain name[*]India Users - OU name[*]India Users Mailboxes – Just a name for the new scope[/LIST]
[CENTER][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/2_thumb.png[/IMG][/CENTER]
Verify Scope create [B]successfully[/B]
[CENTER][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/3_thumb.png[/IMG][/CENTER]
[B]Step :2 – Role Group Creation[/B]

In this step we are going to create new Role Group with set of roles and we are going to assign the scope also.
Go to [B]Start[/B] | [B]All Programs[/B] | [B]Microsoft Exchange Server 2010[/B] | [B]Microsoft Management Shell [/B]| [B]Run New-RoleGroup -Name "Helpdesk India" -Roles "Move Mailboxes" -ManagedBy "Manager" -Members "Supportuser1", "Supportuser2" -RecipientScope "India Users Mailboxes"[/B]
[B]Note[/B]: The following are Variables, this will vary according to your environment

[LIST][*]India Users Mailboxes – Scope name we have created in previous section[*]Supportuser1 and Supportuser2 are target members for this Role group[*]Manager and Administrators are going to manage the Role Groups (Ex: add or remove users in role group)[*]Move Mailboxes is a built-in role[/LIST]
[CENTER][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/4_thumb.png[/IMG][/CENTER]

[LIST][*]Verify command completed successfully[/LIST]
[CENTER][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/5_thumb.png[/IMG][/CENTER]
[B]Step: 3 - Testing[/B]

We have created a Role Group with an Move Mailboxes rights, Now we need to test the solution. We can test the Role group member properties - Open [B]Active Directory Users and Computers[/B] | Search [B]Management Role Group [/B]member - Supportuser1 or Supportuser2 | Right Click Supportuser1 | [B]Properties [/B]| We can see our Management Role Group name [B]Helpdesk India[/B]
[CENTER][B][URL="http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/6.0.png"][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/6.0_thumb.png[/IMG][/URL] [/B][/CENTER]
[B]Note[/B]: In my test environment I have given [B]Remote Desktop User[/B] permission to [B]Supporuser1[/B] and [B]Supportuser2 [/B]. And the Ex2010 server has [B]two Mailbox database[/B]

[LIST][*][B]Logon to [/B]Exchange Server 2010[B] Ex2010 [/B]Server (through [B]MSTSC)[/B] with an [B]Management Role Group [/B]member ID - Supportuser1 or Supportuser2[*]Open Exchange Management Console - [B]Start[/B] | [B]All Programs[/B] | [B]Microsoft Exchange Server 2010[/B] | [B]Microsoft Management Console[/B][/LIST]
[B]Note[/B]: I have clicked the Organization Configuration in EMC, I got the below error because this Supportuser1 has only [B]Move Mailboxes [/B]permission
[CENTER][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/6_thumb.png[/IMG][/CENTER]

[LIST][*]Expand [B]Recipient Configuration[/B] | Select [B]Mailbox [/B]| Right click an user which is part of Scope group (As per our scenario [B]India user1[/B], [B]India User2 [/B]are members of [B]India Users[/B] OU). Right click [B]India User1 [/B]| Select [B]New Local Move request[/B][/LIST]
[CENTER][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/8_thumb.png[/IMG][/CENTER]

[LIST][*]Click [B]Browse[/B][/LIST]
[CENTER][B][URL="http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/9.png"][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/9_thumb.png[/IMG][/URL] [/B][/CENTER]

[LIST][*]Select [B]MailboxDB01 [/B]| Click [B]OK [/B][/LIST]
[B]Note[/B]: In my Lab environment I have two mailbox database so I am testing the solution by moving the mailbox from one database to other.
[CENTER][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/10_thumb.png[/IMG][/CENTER]

[LIST][*]Click [B]Next[/B] to proceed ..[/LIST]
[CENTER][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/11_thumb.png[/IMG][/CENTER]

[LIST][*]Click [B]Next[/B][/LIST]
[CENTER][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/12_thumb.png[/IMG][/CENTER]

[LIST][*]Click [B]New[/B][/LIST]
[CENTER][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/13_thumb.png[/IMG][/CENTER]


[LIST][*]Click [B]Finish [/B]|[B] Congratulation[/B] !!, we have successfully implemented “Role Based Access Control” and tested the functionality.[/LIST]
[CENTER][IMG]http://www.muc-ug.org.in/images/stories/Exchange2010_Articles/RBACRoleBasedAccessControlinExchange2010_A2F1/14_thumb.png[/IMG][/CENTER]
[B]Conclusion

[/B]

Surely this new feature should help us to manage the Exchange 2010 infrastructure in a better way, We have reason to migrate our existing Messaging environment to Microsoft Exchange Server 2010 environment.

[/LEFT]