Exchange 2013 - Org Managers can't manage groups, unless they're the "owner"

My domain admin group has full control on the AD object of all my Exchange distribution groups.  In ECP they do not have the ability to edit group membership unless they are the "owner" of that group.  Is there a way to be able to manage group membership without giving ownership of all the groups to all of my domain admins?

I would have thought, that because they have Full control to the AD object, that they would be able to add/remove membership.  Is there something I'm missing here?


  • Edited by JoeFri Tuesday, August 18, 2015 12:33 PM
May 6th, 2015 12:57pm

Thanks Rhoderick, 

However, I guess i'm still a little confused.  The article you sent is how to allow users to manage a distro but removing the ability to add /remove a distro.  

"How can we solve the challenge of allowing users to managed Distribution Groups that they own, but also prevent them from removing or adding new ones?  Well, its a similar story to the previous blog we will create a custom RBAC Role!"

Also in the first article, that only thing specified that Admins can't do is ( under the Demi-Deities section):

  • Mailbox import export
  • Create un-scoped top level management roles
  • Application impersonation

From all this, it looks to me that from the default role assignments policy and the default RBAC roles that my Admins are assigned, they should already have the access they need, but do not.

Free Windows Admin Tool Kit Click here and download it now
August 19th, 2015 8:51am

I mentioned that as it is the next item that is normally brought up.

Does ETS have permission to the object?

August 19th, 2015 9:47am

Exchange Trusted Subsystem is listed on the OU, and on the objects, but it looks like the same as the Org Management, it looks like a special read:
 

  • Edited by JoeFri 17 hours 10 minutes ago
Free Windows Admin Tool Kit Click here and download it now
August 19th, 2015 10:16am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics