Ticket: Exchange 2010 群組委派設定

-
請教一下，在Exchange 2010中的全球通訊清單中的群組，是否可以委派？
指派有權限的user，可以將人員名單加入/移除適當的群組中，但是不能變更群組管理員，
也不能異動(如更名)或刪除群組！
需求為公司內部有很多專案與業務行為，同仁想依不同的需求，建立專屬的全域通訊群組，
以方便聯絡不同的人(跨部門)；但是這會增加很多IT的工作，所以才想要諮詢這個部份，
是否可以委派給一般usre自行加入/刪除通訊群組成員，但是不能刪除群組。

 
解決方式： 

==============================================
Part 1 使用者及群組設定
==============================================
您的需求可參考下列流程進行設定
1. 建立新的DL - DistributionGroup (也就是通訊群組，群組型態有分Distributio or Security)
  
New-DistributionGroup -Name "Group1" -OrganizationalUnit "MSFT.corp.com/Users" -SamAccountName "Group1" -Type "Security" -DisplayName "Group1"


各參數可參考下列網址
http://technet.microsoft.com/zh-tw/library/aa998856.aspx

2. 接著設定這群組的管理者或多個管理者，為方便可包含管理者所使用的帳號
Set-DistributionGroup -Identity "Group1" -ManagedBy "User1"

詳細設定可參考
http://technet.microsoft.com/en-us/library/dd638201.aspx


3. 接著加入群組成員
Add-DistributionGroupMember -Identity "Group1" -Member User1
Add-DistributionGroupMember -Identity "Group1" -Member User2
Add-DistributionGroupMember -Identity "Group1" -Member User3

若熟悉PowerShell 也可用複合指令來統一加入成員
詳細設定可參考
http://technet.microsoft.com/en-us/library/bb124340.aspx

4. 設定完後的Group manager 只能新增修改群組成員


==============================================
Part 2 群組權限設定，設定啟用管理者可修改群組成員
==============================================
[PS] C:\>Add-ADPermission -Identity "Group1" -User "User1" -AccessRights WriteProperty -Properties "Member"


==============================================
Part 3 Management Role 設定
==============================================
 
請再透過 EMS 執行下列步驟
1. 建立一個新的ManagementRole ，名稱為 "OwnerDistributionGroups"，從父系" MyDistributionGroups"參照權限
[PS] C:\>New-ManagementRole -Name "OwnerDistributionGroups" -Parent "MyDistributionGroups"
Name                                                        RoleType
----                                                        --------
OwnerDistributionGroups                                     MyDistributionGroups

2. 在移除 New & Remove 兩個RoleEntry 的權限，這兩個權限會讓Group owner 有權限新增及移除群組，因您不需要，所以就設定移除。

[PS] C:\>Remove-ManagementRoleEntry "OwnerDistributionGroups"\New-DistributionGroup -Confirm:$false

[PS] C:\>Remove-ManagementRoleEntry OwnerDistributionGroups\Remove-DistributionGroup -Confirm:$false


3. 上述動作完後，自訂Role 的權限及達成需求 (移除群組擁有者"新增及移除"群組的權限)，接著在指派到預設的委派原則中



[PS] C:\>New-ManagementRoleAssignment -Role OwnerDistributionGroups -Policy "Default Role Assignment Policy"

Name                           Role              RoleAssigneeName  RoleAssigneeType  AssignmentMethod  Effectie
----                           ----              ----------------  ----------------  ----------------  -------
OwnerDistributionGroups-Def... OwnerDistribut... Default Role A... RoleAssignment... Direct 

完成設定 

Comments

Post a Comment

Popular posts from this blog

E15 CU3–Update Failed–AD replicated Exceeded the tombstone lifetime.

-
Image
  Exchange 2013 CU3 The naming context is in the process of being removed or is not replicated http://technet.microsoft.com/en-us/library/replication-error-8452-the-naming-context-is-in-the-process-of-being-removed-or-is-not-replicated-from-the-specified-server(v=ws.10).aspx   C:\> REPADMIN /SHOWREPS Root\RDC01 DSA Options: IS_GC Site Options: (none) DSA object GUID: f1694974-47c4-4555-a214-db3c86854aeb DSA invocationID: f1694974-47c4-4555-a214-db3c86854aeb ==== INBOUND NEIGHBORS ====================================== CN=Schema,CN=Configuration,DC=lab7,DC=root     TW\AD02 via RPC         DSA object GUID: bfcc1053-e1da-46fd-8b9d-179c7992...
Read more

202301 - Exchange onpreme - PowerShell Serialization Payload Signing

-
Image
Released: January 2023 Exchange Server Security Updates https://techcommunity.microsoft.com/t5/exchange-team-blog/released-january-2023-exchange-server-security-updates/ba-p/3711808 https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/SerializedDataSigningCheck/ 1.  Update KB5022143 (Exchange SU) 2. Run latest HealthCherker 3.  PowerShell Serialization Payload Signing https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/SerializedDataSigningCheck/ Certificate signing of PowerShell serialization payload in Exchange Server https://support.microsoft.com/en-us/topic/certificate-signing-of-powershell-serialization-payload-in-exchange-server-90fbf219-b0dd-4b2c-8a68-9d73b3309eb1 4.  MonitorExchangeAuthCertificate    https://microsoft.github.io/CSS-Exchange/Admin/MonitorExchangeAuthCertificate/ 5.                 New-SettingOverride -Name "EnableSigningVerification" -Component Data -Secti...
Read more

Ticket: RemoteAPP certificate revocation check error

-
Image
  . certutil -f –urlfetch -verify <your_certificate>.cer From internet client (Win7 ultimate x64) Issuer:     CN=TWCA Secure CA -Evaluation Only     OU=SSL Certification Service Provider-Evaluation Only     O=TAIWAN-CA INC.     C=TW Subject:     CN=deep2.msft.com     OU=ITS     O=Msft Corporation     L=Taipei     S=Taiwan     C=TW Cert Serial Number: 04bd dwFlags = CA_VERIFY_FLAGS_ALLOW_UNTRUSTED_ROOT (0x1) dwFlags = CA_VERIFY_FLAGS_IGNORE_OFFLINE (0x2) dwFlags = CA_VERIFY_FLAGS_FULL_CHAIN_REVOCATION (0x8) dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000) dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000) ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN (0x20000000) HCCE_LOCAL_MACHINE CERT_CHAIN_POLICY_BASE -------- CERT_CHAIN_CONTEXT -------- ChainContext.dwErrorStatu...
Read more