You can configure your Exchange 2013 organization for RBAC split permissions. When you are done, only Active Directory administrators will be able to create Active Directory security principals. This means that Exchange administrators won't be able to use the following cmdlets:

• New-Mailbox
  
  
• New-MailContact
  
  
• New-MailUser
  
  
• New-RemoteMailbox
  
  
• Remove-Mailbox
  
  
• Remove-MailContact
  
  
• Remove-MailUser
  
  
• Remove-RemoteMailbox
  
  

Exchange administrators will only be able to manage the Exchange attributes on existing Active Directory security principals. However, They will be able to create and manage Exchange-specific objects, such as transport rules and distribution groups. For more information, see the "RBAC Split Permissions" section in Understanding Split Permissions.

To configure Exchange 2013 for split permissions, you must assign the Mail Recipient Creation role and the Security Group Creation and Membership role to a role group that contains members that are Active Directory administrators. You must then remove the assignments between those roles and any role group or universal security group (USG) that contains Exchange administrators.

To configure RBAC split permissions, do the following:

1. If your organization is currently configured for Active Directory split permissions, do the following from a Windows command shell prompt.
   
   
   1. Disable Active Directory split permissions by running the following command from the Exchange 2013 installation media.
      
      

      	Copy Code
      setup.exe /PrepareAD /ActiveDirectorySplitPermissions:false

   2. Restart the Exchange 2013 servers in your organization or wait for the Active Directory access token to replicate to all of your Exchange 2013 servers.
      
      

      Note:
      If you have Exchange 2010 servers in your organization, you also need to restart those servers.

2. Do the following from the Exchange Management Shell:
   
   
   1. Create a role group for the Active Directory administrators. In addition to creating the role group, the command creates regular role assignments between the new role group and the Mail Recipient Creation role and the Security Group Creation and Membership role.
      
      

      	Copy Code
      New-RoleGroup "Active Directory Administrators" -Roles "Mail Recipient Creation", "Security Group Creation and Membership"

      Note:

      If you want members of this role group to be able to create role assignments, include the Role Management role. You don't have to add this role now. However, if you ever want to assign either the Mail Recipient Creation role or Security Group Creation and Membership role to other role assignees, the Role Management role must be assigned to this new role group. The steps that follow configure the Active Directory Administrators role group as the only role group that can delegate these roles.

   2. Create delegating role assignments between the new role group and the Mail Recipient Creation role and Security Group Creation and Membership role using the following commands.
      
      

      	Copy Code
      New-ManagementRoleAssignment -Role "Mail Recipient Creation" -SecurityGroup "Active Directory Administrators" -Delegating New-ManagementRoleAssignment -Role "Security Group Creation and Membership" -SecurityGroup "Active Directory Administrators" -Delegating

   3. Add members to the new role group using the following command.
      
      

      	Copy Code
      Add-RoleGroupMember "Active Directory Administrators" -Member <user to add>

   4. Replace the delegate list on the new role group so that only members of the role group can add or remove members.
      
      

      	Copy Code
      Set-RoleGroup "Active Directory Administrators" -ManagedBy "Active Directory Administrators"

      Important:

      Members of the Organization Management role group, or those who are assigned the Role Management role, either directly or through another role group or USG, can bypass this delegate security check. If you want to prevent any Exchange administrator from adding himself or herself to the new role group, you must remove the role assignment between the Role Management role and any Exchange administrator and assign it to another role group.

   5. Find all of the regular and delegating role assignments to the Mail Recipient Creation role using the following command. The command displays only the Name, Role, and RoleAssigneeName properties.
      
      

      	Copy Code
      Get-ManagementRoleAssignment -Role "Mail Recipient Creation" | Format-Table Name, Role, RoleAssigneeName -Auto

   6. Remove all of the regular and delegating role assignments to the Mail Recipient Creation role that aren't associated with the new role group or any other role groups, USGs, or direct assignments you want to keep using the following command.
      
      

      	Copy Code
      Remove-ManagementRoleAssignment <Mail Recipient Creation role assignment to remove>

      Note:
      If you want to remove all of the regular and delegating role assignments to the Mail Recipient Creation role on any role assignee other than the Active Directory Administrators role group, use the following command. The WhatIf switch lets you see what role assignments will be removed. Remove the WhatIf switch and run the command again to remove the role assignments.

      	Copy Code
      Get-ManagementRoleAssignment -Role "Mail Recipient Creation" | Where { $_.RoleAssigneeName -NE "Active Directory Administrators" } | Remove-ManagementRoleAssignment -WhatIf

   7. Find all of the regular and delegating role assignments to the Security Group Creation and Membership role using the following command. The command displays only the Name, Role, and RoleAssigneeName properties.
      
      

      	Copy Code
      Get-ManagementRoleAssignment -Role "Security Group Creation and Membership" | Format-Table Name, Role, RoleAssigneeName -Auto

   8. Remove all of the regular and delegating role assignments to the Security Group Creation and Membership role that aren't associated with the new role group or any other role groups, USGs, or direct assignments you want to keep using the following command.
      
      

      	Copy Code
      Remove-ManagementRoleAssignment <Security Group Creation and Membership role assignment to remove>

      Note:
      You can use the same command in the preceding Note to remove all of the regular and delegating role assignments to the Security Group Creation and Membership role on any role assignee other than the Active Directory Administrators role group, as shown in this example.

      	Copy Code
      Get-ManagementRoleAssignment -Role "Security Group Creation and Membership" | Where { $_.RoleAssigneeName -NE "Active Directory Administrators" } | Remove-ManagementRoleAssignment -WhatIf

For detailed syntax and parameter information, see the following topics:

• New-RoleGroup
  
  
• New-ManagementRoleAssignment
  
  
• Add-RoleGroupMember
  
  
• Set-RoleGroup
  
  
• Get-ManagementRoleAssignment
  
  
• Remove-ManagementRoleAssignment
  
  

You can configure your Exchange 2013 organization for Active Directory split permissions. Active Directory split permissions completely remove the permissions that allow Exchange administrators and servers from creating security principals in Active Directory or modifying non-Exchange attributes on those objects. When you are done, only Active Directory administrators will be able to create Active Directory security principals. This means that Exchange administrators won't be able to use the following cmdlets:

• Add-DistributionGroupMember
  
  
• New-DistributionGroup
  
  
• New-Mailbox
  
  
• New-MailContact
  
  
• New-MailUser
  
  
• New-RemoteMailbox
  
  
• Remove-DistributionGroup
  
  
• Remove-DistributionGroupMember
  
  
• Remove-Mailbox
  
  
• Remove-MailContact
  
  
• Remove-MailUser
  
  
• Remove-RemoteMailbox
  
  
• Update-DistributionGroupMember
  
  

Exchange administrators and servers will only be able to manage the Exchange attributes on existing Active Directory security principals. However, they will be able to create and manage Exchange-specific objects, such as transport rules and Unified Messaging dial plans.

Caution:

After you enable Active Directory split permissions, Exchange administrators and servers will no longer be able to create security principals in Active Directory, and they won't be able to manage distribution group membership. These tasks must be performed using Active Directory management tools with the required Active Directory permissions. Before you make this change, you should understand the impact it will have on your administration processes and third-party applications that integrate with Exchange 2013 and the RBAC permissions model. For more information, see the "Active Directory split permissions" section in Understanding Split Permissions.

To switch from shared or RBAC split permissions to Active Directory split permissions, do the following:

1. From a Windows command shell, run the following command from the Exchange 2013 installation media to enable Active Directory split permissions.
   
   

   	Copy Code
   setup.exe /PrepareAD /ActiveDirectorySplitPermissions:true

2. If you have multiple Active Directory domains in your organization, you must either run setup.exe /PrepareDomain in each child domain that contains Exchange servers or objects or run setup.exe /PrepareAllDomains from a site that has an Active Directory server from every domain.
   
   
3. Restart the Exchange 2013 servers in your organization or wait for the Active Directory access token to replicate to all of you Exchange 2013 servers.
   
   

   Note:
   If you have Exchange 2010 servers in your organization, you also need to restart those servers.