If you want Exchange 2003 administrators to administer Exchange 2010 servers, your Exchange 2003 administrators must be added as members to one or more Exchange 2010 role groups. You can add either users or USGs to role groups. The permissions granted to the role groups will then be applied to the users or USGs you add as members.

Important:
If you use domain local or global Active Directory security groups, you must change them to USGs if you want to add them as members of an Exchange 2010 role group. Exchange 2010 supports only USGs.

The following table provides a mapping between Exchange 2003 administrative roles and Exchange 2010 role groups.

Exchange 2003 administrative roles and Exchange 2010 role groups

If all your Exchange 2003 administrators are members of one of the three Exchange 2003 administrative roles, you need to add the members of each of the administrative groups to their equivalent Exchange 2010 role group. For more information about adding users and USGs to role groups, see Add Members to a Role Group.

If you've modified ACLs on Exchange 2003 objects to grant more granular permissions to Exchange 2003 administrators, and want to assign similar permissions to Exchange 2010 servers to those administrators, you must do the following:

1. Inventory the ACL customization you've done on your Exchange 2003 objects, and identify the administrators granted permissions to each.
   
2. Classify each Exchange 2003 object, for example, whether it's a database, server, or recipient object.
   
3. Map the objects to the corresponding Exchange 2010 role group. For a list of built-in role groups, see Built-in Role Groups.
   
4. Add the USGs or users for each type of object to the corresponding Exchange 2010 role groups. For more information about adding users and USGs to role groups, see Add Members to a Role Group.
   

When you're done, your Exchange 2003 administrators should be members of the role group that maps to the Exchange 2010 objects they need to administer. They can now use the Exchange 2010 management tools to manage the Exchange 2010 servers and recipients.

Important:
In general, Exchange 2003 servers and recipients must be managed by Exchange 2003 management tools, and Exchange 2010 servers and recipients must be managed by Exchange 2010 management tools. For more information, see Exchange 2003 - Planning Roadmap for Upgrade and Coexistence.

If the built-in role groups don't give you the specific set of permissions you want to grant to some administrators, you can create custom role groups. When you create a custom role group, you can choose which roles you want to add to it. This enables you to define the specific features you want members of the role group to manage. For example, if you only want administrators to manage distribution groups, you can create a custom role group and choose just the Distribution Groups role. Members of that custom role group will only be able to manage distribution groups. For more information about how to create custom role groups, see Create a Role Group.

If you've given selective permissions to certain Exchange 2003 objects, such as allowing administrators to administer only specific databases, and you want to apply the same configuration to your Exchange 2010 servers, see "Re-Create Exchange 2003 ACL Customization Using Management Scopes in Exchange 2010" later in this topic.

If you want Exchange 2010 administrators to administer Exchange 2003 servers, you need to add your Exchange 2010 administrators to one of the three Exchange 2003 administrative groups or add them to the appropriate ACLs if you've customized your Exchange 2003 permissions. You can add either users or USGs to Exchange 2003 administrative groups. Role groups are USGs so they can be added directly to Exchange 2003 administrative groups. This topic discusses adding Exchange 2010 administrators to the built-in Exchange 2003 administrative groups.

The same mapping between Exchange 2010 role groups and Exchange 2003 administrative roles that's shown in the "Exchange 2003 administrative roles and Exchange 2010 role groups" table earlier in this topic applies. If you want your Exchange 2010 organization administrators to have full access to your Exchange 2003 administrative roles, add the Organization Management role group to the Exchange Full Administrators administrative group. Do the same with the View Only Organization Management role group and the Exchange View Only administrative group.

When you're done, your Exchange 2010 administrators should be members of the administrative group that maps to the role group they're in. They can now use the Exchange 2003 management tools to manage the Exchange 2003 servers and recipients.

Important:
In general, Exchange 2003 servers and recipients must be managed by Exchange 2003 management tools and Exchange 2010 servers and recipients must be managed by Exchange 2010 management tools. For more information, see Exchange 2003 - Planning Roadmap for Upgrade and Coexistence.

For more information about adding users or USGs to Exchange 2003 administrative groups, see Knowledge Base article 823018, Overview of Exchange administrative role permissions in Exchange 2003.

In Exchange 2003, if you want to restrict who can administer a specific mailbox store, administer specific users, or control which mailbox store mailboxes are created on, you need to modify the ACLs on the objects you want to restrict. Exchange 2010 provides the same capabilities, but without having to modify any ACLs. It does this by making use of management scopes, which are a component of RBAC.

Management scopes provide the ability to use built-in scopes and custom scopes to define what objects administrators can manage. By applying management scopes, you can define which recipients can be administered, which mailbox databases mailboxes can be created on, and which recipients or servers should be administered by a small group of administrators and no one else.

The following types of management scopes can be created:

• Predefined relative   Predefined relative scopes are included with Exchange 2010. You can control what a user sees and is able to modify. For example, predefined relative scopes can control whether users see only information about themselves or information about the whole organization.
  
• Recipient   Recipient scopes control which recipients an administrator can create, modify, or delete. These can be based on an organizational unit (OU), a recipient filter, or both. Recipient filters specify the criteria that a recipient must match to be included in the scope. For example, you might create a recipient filter scope that includes all users in a certain location or in a specific department. You can even combine OUs and recipient filters to match only users who are within a specific OU and only report to a specific manager.
  
• Server   Server scopes control which servers an administrator can manage. You can specify either server lists or server filters. With server lists, you define a static list of servers that can be managed. Server filters work the same way as recipient filters, where you can specify criteria that needs to be matched. For example, you might create a server scope that matches all servers within a particular Active Directory site.
  
• Database   Database scopes control which databases an administrator can manage. They can also control which databases mailboxes can be created on or moved to. Like server scopes, they can be defined as lists or as filters. For example, you might want to create a list or filter that allows administrators to create or move mailboxes on specific mailbox databases managed by a particular subsidiary.
  
• Exclusive   With the exception of predefined relative scopes, any of the preceding scopes can also be created as exclusive scopes. Exclusive scopes work like deny access control entries (ACEs) in ACLs. If anything matches an exclusive scope, only the administrators assigned an exclusive scope can manage that object, even if another scope that's not exclusive, matches the same object. This is especially useful for executives, where you might want only a few highly trusted individuals to be able to manage their mailboxes. Even if another, broader, regular recipient scope includes the executive's mailbox in their scope, the administrators assigned the broader, regular recipient scope won't be able to manage that executive's mailbox unless they are also assigned the exclusive scope.
  

Management scopes are used with management roles, management role assignments, and management role groups to control who can manage what objects, and where. For more information, see the following topics:

• Understanding Management Role Scopes
  
• Understanding Exclusive Scopes
  
• Understanding Management Role Assignments
  
• Understanding Management Role Groups
  
• Understanding Management Roles
  

To create the same permissions model in Exchange 2010 using management scopes that you might have defined in Exchange 2003 using customized ACLs, you need to inventory the ACLs you've customized and create management scopes that match them. You can use the filterable properties available on recipient, server, and database objects, to create management scopes that include the objects you want each management scope to control access to. For more information about the properties you can use with management scope filters, see Understanding Management Role Scope Filters.

For more information about creating management scopes, see Create a Regular or Exclusive Scope.