<rss version="2.0"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:content="http://purl.org/rss/1.0/modules/content/">
  <channel>
    <title>Blog</title>
    <link>http://www.exactsolutions.biz/blog</link>
    <description>Exact Solutions blog</description>
    <language>en-us</language>
    <pubDate>Wed, 08 Feb 2012 03:43:37 -0500</pubDate>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <generator>BlueInk CMS</generator>
        <item>
      <title>Preventing Creation of Archive Mailboxes</title>
      <link>http://www.exactsolutions.biz/blog/2011/4/25/preventing_creation_of_archive_mailboxes</link>
				<description><![CDATA[<p>On a linked in forum I responded to the following query:</p>
<p>Question:&#160; Does anyone know how to prevent Exch admins from creating archive mailboxes in exch2010 sp1?</p>
<p>Answer: Out of the box the only Management Role that has rights to use the cmdlet "New-Mailbox" with parameter -Archive is "Mail Recipient Creation".  Again by default out of the box the Role Groups to whom this Role is assigned are Organization Management and Recipient Management. <br /><br />I gathered this information using the following command lines:<br />Get-ManagementRole -cmdlet new-mailbox -CmdletParameters archive<br />Get-ManagementRoleAssignment -Role "Mail Recipient Creation"<br /><br />So, in order to accomplish this objective one would need to create a custom Management Role based on the "Mail Recipient Creation" Role and then remove the Archive parameter from the New-Mailbox Management Role Entry.</p>
<p>Sample Command lines to accomplish this are shown below:<br />New-ManagementRole -Parent "Mail Recipient Creation" -Name "Mail Recipient Creation Without Archive"<br />Set-ManagementRoleEntry "Mail Recipient Creation Without Archive\New-Mailbox" -Parameters Archive -RemoveParameter<br /><br />Finally you would most likely then need to create a new management role group for your administrators and assign the "Mail Recipient Creation Without Archive" Role to that group along with any other roles that are necessary for your administrators to use in your environment.  That is a good practice in any case since the built in Organization Management Role Group has the ability to delegate any cmdlet to itself (although that could be limited by Active Directory Split Permissions if your organization is in that mode)&#160; The Organization Management Role Group's ability to delegate any cmdlet to itself comes from Role Assignments for every role with the Role Assignment Delegation Type of DelegatingOrgWide as opposed to the delegations of Type "Regular" that are usually made to the other Role Groups.&#160;</p>]]></description>
				      <pubDate>Mon, 25 Apr 2011 11:30:14 -0400</pubDate>
      <guid isPermaLink="false">/blog#html-121</guid>
		      	      		<category>Exchange 2010</category>
      	      		<category>Exchange 2010 SP1</category>
      	      		<category>RBAC</category>
      	          </item>
      </channel>
</rss> 
