To re-create the Organization Management role group as a linked role group, you perform a procedure that's different than the procedure used to re-create other built-in role groups. This is because the Organization Management role group has delegating role assignments between it and all of the management roles. Re-creating the delegating role assignments requires an additional step.

1. Create a USG in the foreign forest that will be linked to the Organization Management role group.
   
   
2. Store the foreign Active Directory forest credentials in a variable.
   
   

   	Copy Code
   $ForeignCredential = Get-Credential

3. Store all of the roles assigned to the Organization Management role group in a variable.
   
   

   	Copy Code
   $OrgMgmt = Get-RoleGroup "Organization Management"

4. Create the Organization Management linked role group and add the roles assigned to the built-in Organization Management role group.
   
   

   	Copy Code
   New-RoleGroup "Organization Management - Linked" -LinkedForeignGroup <name of foreign USG> -LinkedDomainController <FQDN of foreign Active Directory domain controller> -LinkedCredential $ForeignCredential -Roles $OrgMgmt.Roles

5. Remove all of the regular assignments between the new Organization Management linked role group and the My* end-user roles.
   
   

   	Copy Code
   Get-ManagementRoleAssignment -RoleAssignee "Organization Management - Linked" -Role My* | Remove-ManagementRoleAssignment

6. Add delegating role assignments between the new Organization Management linked role group and all management roles.
   
   

   	Copy Code
   Get-ManagementRole | New-ManagementRoleAssignment -SecurityGroup "Organization Management - Linked" -Delegating

This example assumes the following values are used for each parameter:

• LinkedForeignGroup   Organization Management Administrators
  
  
• LinkedDomainController   DC01.users.contoso.com
  
  

Using the preceding values, this example re-creates the Organization Management role group as a linked role group.

Copy Code

$ForeignCredential = Get-Credential $OrgMgmt = Get-RoleGroup "Organization Management" New-RoleGroup "Organization Management - Linked" -LinkedForeignGroup "Organization Management Administrators" -LinkedDomainController DC01.users.contoso.com -LinkedCredential $ForeignCredential -Roles $OrgMgmt.Roles Get-ManagementRoleAssignment -RoleAssignee "Organization Management - Linked" -Role My* | Remove-ManagementRoleAssignment Get-ManagementRole | New-ManagementRoleAssignment -SecurityGroup "Organization Management - Linked" -Delegating

To re-create the built-in role groups (other than the Organization Management role group) as linked role groups, use the following procedure for each group.

1. Create a USG in the foreign forest for each role group that will be linked to each new role group.
   
   
2. Store the foreign Active Directory forest credentials in a variable. You only need to do this once.
   
   

   	Copy Code
   $ForeignCredential = Get-Credential

3. Retrieve a list of role groups using the following cmdlet.
   
   

   	Copy Code
   Get-RoleGroup

4. For each role group, other than the Organization Management role group, do the following.
   
   

   	Copy Code
   $RoleGroup = Get-RoleGroup <name of role group to re-create> New-RoleGroup "<role group name> - Linked" -LinkedForeignGroup <name of foreign USG> -LinkedDomainController <FQDN of foreign Active Directory domain controller> -LinkedCredential $ForeignCredential -Roles $RoleGroup.Roles

5. Repeat the preceding step for each built-in role group you want to re-create as a linked role group.
   
   

This example assumes the following values are used for each parameter:

• LinkedDomainController   DC01.users.contoso.com
  
  
• Built-in role groups to be re-created as linked role groups   Recipient Management, Server Management
  
  
• Foreign group for Recipient Management linked role group   Recipient Management Administrators
  
  
• Foreign group for Server Management linked role group   Server Management Administrators
  
  

Using the preceding values, this example re-creates the Recipient Management and Server Management role groups as linked role groups.

Copy Code

$ForeignCredential = Get-Credential Get-RoleGroup $RoleGroup = Get-RoleGroup "Recipient Management" New-RoleGroup "Recipient Management - Linked" -LinkedForeignGroup "Recipient Management Administrators" -LinkedDomainController DC01.users.contoso.com -LinkedCredential $ForeignCredential -Roles $RoleGroup.Roles $RoleGroup = Get-RoleGroup "Server Management" New-RoleGroup "Server Management - Linked" -LinkedForeignGroup "Server Management Administrators" -LinkedDomainController DC01.users.contoso.com -LinkedCredential $ForeignCredential -Roles $RoleGroup.Roles