Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're in the middle of migrating to Exchange 2010. When it's done, our SA in charge of Exchange will be moving to a non-technical position within the department. We're taking this opportunity to review Exchange administration procedures, which raises the question:

If the Exchange admin's sole responsibility is managing MS Exchange, does that person need an account that's a member of Domain Administrators? If not, are there any documents available describing least-permission for SAs managing Exchange?

share|improve this question
Is there any additional information I can provide you so we can make the answer appropriately? – JohnThePro Feb 13 '12 at 15:55
Well, I haven't implemented this yet, and likely won't for a few weeks. I'm not going to accept an answer until I've tested it and verified that it meets my needs. Don't worry, you'll get your little green check mark eventually :) – MDMarra Feb 13 '12 at 16:00
No worries, I'm just not a fan of loose ends. :) – JohnThePro Feb 13 '12 at 17:38
I take it all seems well? – JohnThePro Mar 15 '12 at 14:23
up vote 3 down vote accepted

I think you'll find Exchange 2010's RBAC (Role Based Access Control) a PERFECT fit for the situation you're facing. It allows you to define levels of groups and roles responsible for certain tasks within Exchange, without exposing them to additional permissions within Active Directory itself.

Here's the TechNet article on RBAC for you to read as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.