Export (0) Print
Expand All

Server Infrastructure Roles in MDM

2/9/2009

System Center Mobile Device Manager uses role-based access control. Unlike an authentication system that specifies who a user is, role-based access is an authorization system that specifies what a user is authorized to access and what tasks that person can perform.

The following shows the server infrastructure roles:

  • DeviceManagementServers
  • EnrollmentServers
  • SelfService

These roles are represented through MDM infrastructure groups that the Active Directory Configuration Tool (ADConfig) creates. For more information about these groups, see ADConfig Tool.

The following shows the tasks that each infrastructure role gives users.

DeviceManagementServers

The DeviceManagementServers role is represented through the SCMDMDeviceManagementServers (<instance name>) infrastructure group that ADConfig creates.

The following shows the tasks that a user who has the DeviceManagementServers role can perform.

Cmdlet Task

Add-BlockedDevice

Add a compromised managed Windows Mobile device to the blocked device table.

Get-MDMCurrentInstance

Return an MDMInstance object that represents the instance that the current MDM Shell is managing.

Get-MDMInstance

Return an MDMInstance object that represents the MDM instances in an organization.

EnrollmentServers

The EnrollmentServers role is represented through the SCMDMEnrollmentServers (<instance name>) infrastructure group that ADConfig creates.

The following shows the tasks that a user who has the EnrollmentServers role can perform.

Cmdlet Task

Get-BlockedDevice

Return information about the current set of managed devices that are blocked.

Get-MDMCurrentInstance

Return an MDMInstance object that represents the instance that the current MDM Shell is managing.

Get-MDMInstance

Return an MDMInstance object that represents the MDM instances in an organization.

SelfService

The SelfService role is represented through the SCMDMSelfServiceServers (<instance name>) infrastructure group that ADConfig creates.

The following shows the tasks that a user who has the SelfService role can perform.

Cmdlet Task

Get-DeviceManagementConfig

Return the current global device management configuration.

Get-EnrollmentConfig

Return the current configuration of the Enrollment service.

Get-EnrollmentRequest

Return pending managed device enrollment requests.

Get-MDMCurrentInstance

Return an MDMInstance object that represents the instance that the current MDM Shell is managing.

Get-MDMDevice

Return information about devices that MDM manages.

Get-MDMDeviceStatus

Return status information for the specified managed device.

Get-MDMGlobalGatewayConfig

Return the global virtual private network (VPN) settings shared among all computers that are running MDM Gateway Server.

Get-MDMInstance

Return an MDMInstance object that represents the MDM instances in an organization.

Get-MobilePolicyServiceConfig

Return the current configuration of the Group Policy service.

Get-SoftwareDistributionConfig

Return the current configuration of MDM software distribution service.

Get-WipeConfig

Return the current configuration of the wipe service.

Get-WipeRequest

Return the unprocessed wipe requests for the specified managed device.

New-EnrollmentRequest

Create a new managed device enrollment request.

New-WipeRequest

Create a new wipe request that deletes all content on the targeted managed device.

Remove-EnrollmentRequest

Remove a pending enrollment request for a managed device.

Remove-WipeRequest

Remove a wipe request for the specified managed device if the wipe request is yet unprocessed.

Set-MDMCurrentInstance

Configure the current MDM Console to manage a specific MDM instance.

Dd261822.note(en-us,TechNet.10).gifNote:
Anyone who has access to MDM Console can run this cmdlet.

The following shows the tasks that each role can perform.

Cmdlet Task Required Admin Role

Add-BlockedDevice

Add a compromised managed device to the blocked device table.

DeviceManagementServers

Get-BlockedDevice

Return information about the current set of managed devices that are blocked.

EnrollmentServers

Get-DeviceManagementConfig

Return the current global device management configuration.

SelfService

Get-EnrollmentConfig

Return the current configuration of the Enrollment service.

SelfService

Get-EnrollmentRequest

Return pending managed device enrollment requests.

SelfService

Get-MDMCurrentInstance

Return an MDMInstance object that represents the instance that the current MDM Shell is managing.

DeviceManagementServers

EnrollmentServers

SelfService

Get-MDMDevice

Return information about managed devices that controls.

SelfService

Get-MDMDeviceStatus

Return status information for the specified managed device.

SelfService

Get-MDMGlobalGatewayConfig

Return the global virtual private network (VPN) settings shared among all computers that are running MDM Gateway Server.

SelfService

Get-MDMInstance

Return an MDMInstance object that represents the MDM instances in an organization.

DeviceManagementServers

EnrollmentServers

SelfService

Get-MobilePolicyServiceConfig

Return the current configuration of the Group Policy service.

SelfService

Get-SoftwareDistributionConfig

Return the current configuration of MDM software distribution service.

SelfService

Get-WipeConfig

Return the current configuration of the wipe service.

SelfService

Get-WipeRequest

Return the unprocessed wipe requests for the specified managed device.

SelfService

New-EnrollmentRequest

Create a new managed device enrollment request.

SelfService

New-WipeRequest

Create a new wipe request that deletes all content on the targeted managed device.

SelfService

Remove-EnrollmentRequest

Remove a pending enrollment request for a managed device.

SelfService

Remove-WipeRequest

Remove a wipe request for the specified managed device if the wipe request is yet unprocessed.

SelfService

Set-MDMCurrentInstance

Configure the current MDM Console to manage a specific MDM instance.

Dd261822.note(en-us,TechNet.10).gifNote:
Anyone who has access to MDM Console can run this cmdlet.

SelfService

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft