I've created a new Role Groups which has a custom role assignment "Mail Recipients - Custom" that only permits the following role entries:

Get-mailbox
Get-CalendarProcessing

When running Get-CalendarProcessing the "-DomainController" switch is not available. It's available under get-mailbox though. How can I enable the "-DomainController" switch for Get-CalendarProcessing in RBAC?

Chris

Hi Chris,

Thank you for your question.

The parameter of -DomainController of Get-CalendarProcessing was only used on Exchange 2013.

Is there any error when we run Get-CalendarProcessing with -DomainController?

Post error to ibsexc@microsoft.com for our troubleshooting.

We could run Powershell as administrator to check if the issue persist.

If there are any questions regarding this issue, please be free to let me know.

Best Regard,

Jim

Hi Chris,

If I understood you correctly, what you are looking for is - allowed parameters with the Get-CalendarProcessing cmdlet on the Mail Recipients - Custom role.

Just to confirm, compare if it exists for the built-in Mail Recipients role or not.

#List all Roles with the cmdlet and parameter:
Get-ManagementRoleEntry *\Get-CalendarProcessing" parameter DomainController
#List all parameters for the cmdlet of the specific role:
(Get-ManagementRoleentry "Mail Recipients\Get-CalendarProcessing").Parameters

(Get-ManagementRoleentry "Mail Recipients - Custom\Get-CalendarProcessing").Parameters

If missing you can add the parameter:

Add-ManagementRoleEntry "Mail Recipients - Custom\Get-CalendarProcessing"  -Parameters DomainController

Nice guide to run through common RBAC queries:

Exchange RBAC Tips N Tricks - PowerShell

References:

RBAC Made Easy (Part 4)

How To Add Or Remove Cmdlet Parameter From RBAC Management Role

Hi Chris,

Hope you are On-Premises Exchange 2013 and not Exchange Online.

Get-CalendarProcessing

Parameter: DomainController

Description: This parameter is available only in on-premises Exchange 2013.

The DomainController parameter specifies the fully qualified domain name (FQDN) of the domain controller that retrieves data from Active Directory.

When I try to add the -DomainController parameter I get the following error:

Hi ,

Thank you for your question.

This error means Get-CalendarProcessing has been exited in Mail Recipients Automation Mgmt. it mean we could use the parameter of -DomainController in Get-CalendarProcessing. If you could not use the parameter of -DomainController, You could post error when we user the parameter of -DomainController in Get-CalendarProcessing.

If you just want to use the parameter of -DomainCtroller, we could refer to the following two steps:

1.        Remove Get-CalendarProcessing from Mail Recipient Auitomation Mgmt:

Remove-ManagementRoleEntry Mail Recipients Automation Mgmt\Get-CalendarProcessing

   2.          Then we add the parameter -DomainController in Get-CalendarProcessing:

Add-ManagementRoleEntry Mail Recipients Automation Mgmt\Get-CalendarProcessing parameters DomainController

If there are any questions regarding this issue, please be free to let me know.

Best Regard,

Hi Chris,

I would need the results from the Get- sections as well to analyze your case.

Try this: Make sure to add all the required parameters with comma

The Get- cmdlet would list your existing parameter if you need to know.

Set-ManagementRoleEntry "Mail Recipient Auitomation Mgmt\Get-CalendarProcessing" -Parameters DomainController,MobilePhone, Identity