By default, all online and healthy mailbox databases on Exchange 2010 servers in the local Active Directory site can be chosen by automatic mailbox distribution to store a new or moved mailbox. However, you might want to exclude some databases from the distribution process for various reasons. For example, you may designate a mailbox database as a journaling database in which only mailboxes you manually specify should be located. Or you might want to temporarily remove a database from rotation to perform scheduled maintenance. Exchange 2010 gives you the option to either permanently or temporarily exclude databases from the exclusion process.

Every Exchange 2010 mailbox database has the two following properties that can be set using the Set-MailboxDatabase cmdlet:

• IsExcludedFromProvisioning   Use this property if you want to indicate that the database should be permanently excluded from automatic mailbox distribution.
  
  
• IsSuspendedFromProvisioning   Use this property if you want to indicate that the database should be temporarily excluded from automatic mailbox distribution.
  
  

Both properties have two valid values, $True and $False. The default value for each is $False. The property you choose is purely for your information. Setting either property to $True has the same result of excluding the database from the automatic distribution process. Both properties must be set to $False for a mailbox database to be included in the automatic distribution process.

Exchange 2010 provides these two properties for excluding a mailbox database from automatic distribution so that you can easily identify the databases that have been permanently excluded from automatic distribution and which have been temporarily excluded.

To set a mailbox database as permanently excluded from automatic distribution, use the following command:

	Copy Code
Set-MailboxDatabase <database name> -IsExcludedFromProvisioning $True

To set a mailbox database as temporarily excluded from automatic distribution, use the following command:

	Copy Code
Set-MailboxDatabase <database name> -IsSuspendedFromProvisioning $True

When a mailbox database is excluded from automatic distribution, the only way to create a mailbox in, or move a mailbox to, the database is to use the Database parameter on the New-Mailbox and Enable-Mailbox cmdlets or the TargetDatabase parameter on the New-MoveRequest cmdlet.

If you want to make an excluded mailbox database available for selection in the automatic distribution process, set both properties to $False.

Database management scopes are an additional level of control over the automatic mailbox distribution process that's been added to Microsoft Exchange Server 2010 Service Pack 1 (SP1). If a mailbox database is online and healthy, it's in the local Active Directory site, and it isn't excluded from the automatic distribution process, Exchange 2010 SP1 checks to see if the mailbox database is included in the database scope applied to the administrator running the cmdlet. If it's included in the database scope, it's included in the list of databases available to that administrator.

Database scopes are part of the Role Based Access Control (RBAC) permissions model. For more information about RBAC and database scopes, see the following topics:

• Understanding Role Based Access Control
  
  
• Understanding Management Role Scopes
  
  

Database scopes can be useful if you have many mailbox databases in your local Active Directory site that are available to automatic distribution, but you want to limit which databases can be used by certain sets of administrators. For example, your Exchange 2010 SP1 servers may serve several agencies but you only want to allow each agency to create or move mailboxes to mailbox databases that are allocated to them.

By default, all administrators in an Exchange 2010 SP1 organization can see all of the mailbox databases in the organization. To limit the databases that they can see, and therefore limit the databases they can potentially create mailboxes in or move mailboxes to, you must do the following:

1. Create a custom database management scope using the New-ManagementScope cmdlet that includes only the mailbox databases you want the administrator to use.
   
   
2. Associate the new database scope with a management role assignment in one of the following ways:
   
   
   • Add the new database scope to an existing management role assignment using the CustomConfigWriteScope parameter on the Set-ManagementRoleAssignment cmdlet. The database scope is now applied to the management role group, universal security group (USG), or user assigned the role assignment.
     
     
   • Create a management role assignment using the New-ManagementRoleAssignment cmdlet and use the CustomConfigWriteScope parameter to specify the new database scope. You can create a role assignment between a management role and a role group, USG, or user.
     
     
3. If you created a role assignment to a role group or USG, add users to the role group or USG so that the role assignment and database scope are applied to the users.
   
   
4. If applicable, remove the user (or users who are members of role groups or USGs you created in the preceding steps) you assigned the new role assignment to from any other role groups or USGs that might be assigned a database scope that contains databases you don't want them to access.
   
   
5. Verify that the administrators have access only to the databases they should have access to.
   
   

After you complete these steps, the administrators that are assigned role assignments with the database scopes you created will only be able to create mailboxes in or move mailboxes to the databases you specified.

For more information about how to use database scopes to limit which mailbox databases are available to administrators, see Control Automatic Mailbox Distribution Using Database Scopes.