Exchange 2010: Can you scope permissions to more than one OU?

Article
06/22/2011

About a month ago I got the following mail:

Hi Ilse I know you had a RBAC Session at Teched. We tried to scope to multiple OU's as described in this article without any success. http://technet.microsoft.com/en-us/library/dd638181(EXCHG.149).aspx RecipientOrganizationalUnitScope use the syntax: domain /OU 1/OU 2/OU N (where N is the designation of each of the specified OUs). Unfortunately we can't find a real example. Have you ever tried this parameter with multiple OU's Thanks in advance Fabian

Not sure why it wouldn’t work as stated in the TechNet Article, it was definitely an interesting question to check out.

Step 1. Setting the scene…

In my demo environment I have a few Organizational Units, as can be seen in the print screen here:

The goal would be to create a new group “Studio & Zaventem Admins”, and hand that group the right to manage the mail recipients in the Organizational Units Zaventem, and Studio:

Step 2. Follow the steps defined in the mentioned TechNet article

First try, create a new rolegroup, called Studio Admins, that will get the role of Mail Recipients, and will be able to manage a recipients located in the OU Studio, using the EMS line:

New-RoleGroup –Name “Studio Admins” –Roles “Mail Recipients” –RecipientOrganizationalUnitScope studio

And this one worked like a charm:

So now time to follow what’s specified in the TechNet article:

And enter the following line using the wonderful EMS:

New-RoleGroup –Name “Studio Admins” –Roles “Mail Recipients” –RecipientOrganizationalUnitScope studio,zaventem

But unfortunately, no go…

Using the Exchange Control Panel, no go either….

Question =

Does this mean it is impossible to scope a management role to more than one Organizational Unit?

Answer =

No Smile

Question =

How?

Answer =

Using nested OU’s…or using the power of RecipientFilters…(thank you Bharat Suneja for pointing this out)

Since I’m not using nested OU’s, I have to turn to RecipientFilters…

Step 3. Create a Custom Management Scope

Time to create a custom management scope, which includes the two Organizational Units, by using the RecipientRestrictionFilter.

Problem is that OrganizationalUnit is not in the list of filterable properties, all these properties are listed here:

http://technet.microsoft.com/en-us/library/bb738155(EXCHG.80).aspx

But, it is possible to use the DistinguishedName, which includes the Organization Unit:

So using the following RecipientRestrictionFilter will cover the two Organization Units in my environment:

New-ManagementScope –Name “Studio & Zaventem Admins” –RecipientRestrictionFilter { (DistinguishedName –Like “*,OU=Studio,DC=Lync,DC=local”) –OR (DistinguishedName –Like “*,OU=Zaventem,DC=Lync,DC=local”) }