Johnny Yao WorkSpace

問題定義 : 1. RBAC delgate permission (database/ recipient management) to child domain 服務範圍 : 1. Provide how to setup RBAC delegate permission (database/ recipient management) to child domain 原因說明 : 解決方式 : Symptom ===== RBAC delegation permission (database/ recipient management) to child domain Resolution ============== Commands 1.            New-ManagementScope -Name "ServerInContoso" -ServerList  EX1, EX2, EX3 2.            New-ManagementScope -name "RecipientInContoso" -RecipientRoot "Contoso.msft.corp" -RecipientRestrictionFilter {name -like '*'} –verbos 3.            $RoleGroup = Get-RoleGroup "Server Management" 4.            New-RoleGroup "Server Management - Contoso" -Roles $Role...

  http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/3d408093-5026-470d-92d5-33575ec365dd/   By default, only member of Organization Management group can run the cmdlet. Add-ADPermission http://technet.microsoft.com/en-us/library/bb124403.aspx Please also run the Exbpa in the Toolbox to do "Permission Check".

  http://blogs.technet.com/b/exchange/archive/2011/03/28/iorepl-and-exchange-2010-sp1.aspx   Migrating Permissions Once the preparation, installation, configuration and testing phases are complete and you are successfully able to replicate public folders and free/busy content between Exchange organizations, the next phase is to export Public folder permissions. In order to do that, we need PFDAVAdmin to export permissions on Exchange 2003 side and ExFolders to import permissions on Exchange 2010 side. Note: It's important to retain public folder replicas on Exchange Server 2003 until all mailboxes have been migrated to Exchange Server 2010. This is to allow for access to public folders via Exchange 2003 OWA as well as Exchange 2010 Outlook Web App. It's assumed that you have already followed the steps to move mailboxes cross forest as explained in Exchange 2010 Cross Forest Mailbox Moves . You can use either the legacyExchangeDN or the account name (Domain\User)...

  http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/2a6b612a-132f-4d91-a0ee-70daff8b039f/ http://technet.microsoft.com/zh-tw/library/bb430793.aspx 停止萬用通訊群組與萬用安全性群組的自動轉換 萬用通訊群組和萬用安全性群組，是為了迅速大量傳送電子郵件和其他資訊而建立的收件者群組。然而，與萬用通訊群組不同，萬用安全性群組還可以用來指派權限。 在 Microsoft Exchange 中，只有具有安全性主體的 Active Directory 物件才可以用來授與公用資料夾或信箱資料夾的權限。然而，Microsoft Outlook 使用者可以使用萬用通訊群組來授與公用資料夾或信箱資料夾的權限。在此情況下，Microsoft Exchange 資訊儲存庫服務會將萬用通訊群組自動轉換為萬用安全性群組。這是 Exchange Server 2010 和 Exchange Server 2007 中的預設行為。 您可以修改這個行為，防止將萬用通訊群組自動轉換為萬用安全性群組。在 Active Directory 中，Exchange 組織物件的 msExchDisableUDGConversion 屬性是用來控制 Microsoft Exchange 資訊儲存庫服務如何回應萬用通訊群組與萬用安全性群組的轉換要求。下列是 msExchDisableUDGConversion 屬性的可接受值： 0    如果屬性設為 0 或未設定，則會在使用萬用通訊群組授與公用資料夾或信箱資料夾的權限時，將萬用通訊群組自動轉換為萬用安全性群組。 1    如果屬性設為 1，則 Outlook 無法要求轉換。然而，Exchange 系統處理程序仍然可以將萬用通訊群組轉換為萬用安全性群組。 2    如果屬性設為 2，則不會進行自動轉換。

    Correct self permission incorrect self permission

Active Directory operation failed on dc13.msft.corp.com. This error is not retr iable. Additional information: 存取權限不足，無法執行操作。. Active directory response: 00002098: SecErr: DSID-03150A45, problem 4003 (INSUF F_ACCESS_RIGHTS), data 0    + CategoryInfo          : NotSpecified: (:) [New-ExchangeCertificate], Inv    alidOperationException    + FullyQualifiedErrorId : 77F5CDDB,Microsoft.Exchange.Management.SystemCon    figurationTasks.NewExchangeCertificate This group contains Exchange servers that run Exchange cmdlets on behalf of users via Management service. Its members will have permission to read and modify all Exchange configuration , as well as user accounts and groups. This group should not be deleted.