Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're in the middle of migrating to Exchange 2010. When it's done, our SA in charge of Exchange will be moving to a non-technical position within the department. We're taking this opportunity to review Exchange administration procedures, which raises the question:

If the Exchange admin's sole responsibility is managing MS Exchange, does that person need an account that's a member of Domain Administrators? If not, are there any documents available describing least-permission for SAs managing Exchange?

share|improve this question
    
Is there any additional information I can provide you so we can make the answer appropriately? –  JohnThePro Feb 13 '12 at 15:55
    
Well, I haven't implemented this yet, and likely won't for a few weeks. I'm not going to accept an answer until I've tested it and verified that it meets my needs. Don't worry, you'll get your little green check mark eventually :) –  MDMarra Feb 13 '12 at 16:00
    
No worries, I'm just not a fan of loose ends. :) –  JohnThePro Feb 13 '12 at 17:38
    
I take it all seems well? –  JohnThePro Mar 15 '12 at 14:23
add comment

1 Answer

up vote 3 down vote accepted

I think you'll find Exchange 2010's RBAC (Role Based Access Control) a PERFECT fit for the situation you're facing. It allows you to define levels of groups and roles responsible for certain tasks within Exchange, without exposing them to additional permissions within Active Directory itself.

Here's the TechNet article on RBAC for you to read as well.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.