When you create a role group, you create the USG that holds the members of the role group, and you create the assignments between the role group and the management roles you specify. Optionally, you can also specify a management scope to apply to the role assignments, and you can add any mailboxes that you want to be members of the new role group.

After you create a role group, each layer becomes an independent object. The role group continues to be the central point at which all of the layers are joined together, however, each layer is managed individually. For example, to modify the management scope that you applied to the role group when it was created, you need to change the scope on each individual role assignment after the role group is created. The management of the role group model is performed using the cmdlets that manage the individual layers of the role group model.

The following table lists the role group layer and the procedural topics that you can use to manage each layer.

Role group management topics

Role group model layer	Management topic
Role holder	Add Members to a Role Group Remove Members from a Role Group
Role group	Create a Role Group Change a Linked Foreign USG on a Linked Role Group Add or Remove a Role Group Delegate Remove a Role Group
Management roles and assignments	Add a Role to a Role Group Remove a Role from a Role Group Change the Scope of Role Assignments in a Role Group
Management role entries	Add a Role Entry to a Role Change a Role Entry Remove a Role Entry from a Role Note: Changing the management role entries in management roles in a role group is an advanced task and is generally not required in most cases. You may, instead, be able to use a preexisting management role that suits your requirements. For more information, see Built-in Role Groups.

Return to top

Built-in roles groups are roles shipped with Exchange 2010. They provide you with a set of role groups that you can use to provide varying levels of administrative permissions to groups of users. You can add or remove users to or from any built-in role group. You can also add or remove role assignments to or from most role groups. The only exceptions are the following:

• You can't remove any delegating role assignments from the Organization Management role group.
  
• You can't remove the Role Management role from the Organization Management role group.
  

The following table lists all of the built-in role groups included with Exchange 2010. For more information about built-in role groups, see Built-in Role Groups.

Built-in role groups

Return to top

Linked role groups are used in organizations that install Exchange 2010 in a dedicated resource forest and place users in other, trusted foreign forests. Linked role groups, as the name implies, create a link between a role group in the Exchange forest and a USG in a foreign forest. This is useful when the Active Directory Domain Services (AD DS) user accounts of the administrators you want to administer Exchange don't reside in the same resource forest as Exchange. Linked role groups can only be associated with one foreign USG. Additionally, you don't need to create a two-way trust between the Exchange forest and the foreign forest. The Exchange forest needs to trust the foreign forest but the foreign forest doesn't need to trust the Exchange forest.

For more information about permissions in multiple-forest topologies, see Understanding Multiple-Forest Permissions.

A linked role group consists of two parts:

• Linked role group   The linked role group is a container object that associates the foreign USG with the management role assignments assigned to the role group.
  
• Foreign USG   The foreign USG contains the members that should be granted the permissions provided by the linked role group.
  

When you create a linked role group, you provide a domain controller in the foreign forest that contains the users you want to manage the Exchange forest and the USG that contains those users as members, the foreign USG name, and the credentials required to access the foreign forest. Exchange adds the security identifier (SID) of the foreign USG to the linked role group. Because the USG SID is the only identification of the foreign USG, we strongly recommend that you specify the foreign forest in the name of the role group if you have multiple foreign forests.

A linked role group doesn't contain any members. All of the members of that role group are managed using the foreign USG. This means you can't use the Update-RoleGroupMember, Add-RoleGroupMember, or Remove-RoleGroupMember cmdlets to add or remove role group members. When you add members to the foreign USG, they are given the permissions provided by the linked role group.

You can't change a standard role group, which contains its own members, to a linked role group and vice versa. If you want to change a role group from a standard role group to a linked role group, you must create a new linked role group and replicate the management role assignments that are present on the standard role group on the linked role group. This is also the case for built-in role groups because they're standard role groups. If you want to perform all of the management of your Exchange forest from a foreign forest, you need to create new linked role groups and add the management roles that exist on the built-in role groups to the new linked role groups. For more information about how to accomplish this, see Create Linked Role Groups that Mirror Built-in Role Groups.

For more information about deploying Exchange in a resource forest, see Deploy Exchange 2010 in an Exchange Resource Forest Topology.

Return to top

By default, members of the Organization Management role group can add and remove members to and from role groups. However, you might want to enable users who aren't members of the Organization Management role group to add and remove role group members. If so, you can use role group delegation.

Role group delegation is controlled by the ManagedBy property on each role group. The ManagedBy property contains a list of users who can add and remove members to and from that role group or change the configuration of a role group. The users aren't assigned any permissions given by the role group unless they're also members of the role group.

If the ManagedBy property is set on a role group, only those users who are listed as role group managers on that property can modify a role group or the membership of a role group by default. However, an optional parameter on cmdlets that modify role groups or role group membership can override that restriction. The BypassSecurityGroupManagerCheck switch can be used by users who are members of the Organization Management role or are assigned, either directly or indirectly, the Role Management management role. When this switch is used, the ManagedBy property is ignored and the user can modify the role group or role group membership.

If the ManagedBy property isn't set on a role group, only users who are members of the Organization Management role or are assigned, either directly or indirectly, the Role Management management role can modify a role group or role group membership.

Note:

Roles assigned to a role group may be assigned using delegating role assignments. With delegating role assignments, members of a role group that's assigned a delegated role can assign that role to another role group, assignment policy, user, or USG. Members of the role group can assign only that role and can't delegate the role group, unless they're also added to the ManagedBy property. For more information about delegated role assignments, see Understanding Management Role Assignments.

For more information about how to manage role group delegation, see Add or Remove a Role Group Delegate.

Return to top

When a user is made a member of a role group, the management roles assigned to the role group are assigned to the user. If a user is a member of multiple role groups, the management roles from each role group are aggregated and assigned to the user. Users, USGs, and other role groups can be members of role groups.

Only users who are members of the Organization Management or Role Management role groups and users who have been delegated the ability to add and remove users to or from role groups can manage role group membership.

For more information about how to manage role group membership, see the following topics:

• Add Members to a Role Group
  
• Remove Members from a Role Group
  
• View the Members of a Role Group
  

As mentioned previously, a role group is made up of several layers. To help you understand what happens when a role group is created, consider the following example, which creates a new role group.

New-RoleGroup -Name "Seattle Recipient Management" -Roles "Mail Recipients", "Distribution Groups", "Move Mailboxes", "UM Mailboxes", "Reset Password" -CustomRecipientWriteScope "Seattle Users", -ManagedBy "Brian", "David", "Katie" -Members "Ray", "Jens", "Maria", "Chris", "Maira", "Carter", "Jesse", "Lukas", "Isabel", "Rick", "Katie"

When the preceding command is run, the following happens:

1. A new role group object, which is a special USG, called Seattle Recipient Management is created.
   
2. The mailboxes for Ray, Jens, Maria, Chris, Maira, Carter, Jesse, Lukas, Isabel, Rick, and Katie are added as members of the role group. These users receive the permissions provided by this role group.
   
3. The users Brian and David are added to the ManagedBy property of the role group. These users can add and remove members to and from the role group but won't be given any permissions provided by the role group because they're not members. Katie is also added to the ManagedBy property of the role group. Because she's added to the ManagedBy property, and she's a member of the role group, she can add or remove members to and from the role group, and she also receives the permissions provided by the role group.
   
4. The following management role assignments are created. The role assignments assign each management role specified in the command to the role group. The management scope Seattle Users is added to each role assignment. The name of each role assignment is a combination of the management role being assigned and the role group name.
   
   1. Mail Recipients_Seattle Recipient Management
      
   2. Distribution Groups_Seattle Recipient Management
      
   3. Move Mailboxes_Seattle Recipient Management
      
   4. UM Mailboxes_Seattle Recipient Management
      
   5. Reset Password_Seattle Recipient Management
      

If you compare the results of this command to the Management role group layers figure earlier in this topic, you can see where each step correlates to the role group layers. You can then refer to the Management role group management topics shown in "Role Group Management" earlier in this topic to manage each role group layer.

Return to top