The following table lists the settings that you can specify and the Active Directory attributes to which they correspond when you use the Set-User cmdlet in the Exchange Management Shell. The attributes listed in this section relate to Microsoft Exchange. Therefore, they represent only a subset of what each task provides.

Set-User properties

The following table lists the settings that you can specify and the Active Directory attributes to which they correspond when you use the Set-MailUser cmdlet in the Exchange Management Shell. The attributes listed in this section relate to Microsoft Exchange. Therefore, they represent only a subset of what each task provides.

Set-MailUser properties

The following table lists the settings that you can specify and the Active Directory attributes to which they correspond when you use the Set-Mailbox cmdlet in the Exchange Management Shell. The attributes listed in this section relate to Microsoft Exchange. Therefore, they represent only a subset of what each task provides.

Set-Mailbox properties

The following table lists the settings that you can specify and the Active Directory attributes to which they correspond when you use the Set-CASMailbox cmdlet in the Exchange Management Shell. The attributes listed in this section relate to Microsoft Exchange. Therefore, they represent only a subset of what each task provides.

Set-CASMailbox properties

The following table lists the settings that you can specify and the Active Directory attributes to which they correspond when you use the Set-UMMailbox cmdlet in the Exchange Management Shell. The attributes listed in this section relate to Microsoft Exchange. Therefore, they represent only a subset of what each task provides.

Set-UMMailbox properties

The following table lists the settings that you can specify and the Active Directory attributes to which they correspond when you use the Set-Contact cmdlet in the Exchange Management Shell. The attributes listed in this section relate to Microsoft Exchange. Therefore, they represent only a subset of what each task provides.

Set-Contact properties

The following table lists the settings that you can specify and the Active Directory attributes to which they correspond when you use the Set-MailContact cmdlet in the Exchange Management Shell. The attributes listed in this section relate to Microsoft Exchange. Therefore, they represent only a subset of what each task provides.

Set-MailContact properties

The following table lists the settings that you can specify and the Active Directory attributes to which they correspond when you use the Set-Group cmdlet in the Exchange Management Shell. The attributes listed in this section relate to Microsoft Exchange. Therefore, they represent only a subset of what each task provides.

Set-Group properties

The following table lists the settings that you can specify and the Active Directory attributes to which they correspond when you use the Set-DistributionGroup cmdlet in the Exchange Management Shell. The attributes listed in this section relate to Microsoft Exchange. Therefore, they represent only a subset of what each task provides.

Set-DistributionGroup properties

The following table lists the settings that you can specify and the Active Directory attributes to which they correspond when you use the Set-DynamicDistributionGroup cmdlet in the Exchange Management Shell. The attributes listed in this section relate to Microsoft Exchange. Therefore, they represent only a subset of what each task provides.

Set-DynamicDistributionGroup properties

New in Exchange 2007 Service Pack 1 (SP1)

The following table lists the settings that you can specify and the Active Directory attributes to which they correspond when you use the Set-MailPublicFolder cmdlet in the Exchange Management Shell. The attributes listed in this section relate to Microsoft Exchange. Therefore, they represent only a subset of what each task provides.

Set-MailPublicFolder properties

The following table lists the attributes that can be viewed on the General tab of mailbox-enabled user objects when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the General tab of mail-enabled user or mail-enabled inetOrgPerson or mail-enabled contact objects when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the General tab of mail-enabled group and dynamic distribution group objects when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the User Information tab of user or inetOrgPerson objects when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the User Information tab of contact objects when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the Address and Phone tab of user, inetOrgPerson, and contact objects when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the Organization tab of user, inetOrgPerson, and contact objects when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the Group Information tab of group and dynamic group objects when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the E-Mail Addresses tab of a user, inetOrgPerson, group, dynamic distribution group, contact, or public folder object when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the Mailbox Settings tab of a mailbox-enabled user or inetOrgPerson object when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the Mail Flow Settings tab of a mailbox-enabled user or inetOrgPerson object when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the Mail Flow Settings tab of a mail-enabled user, mail-enabled inetOrgPerson, mail-enabled contact, or distribution group objects when you use the Exchange Management Console.

New in Exchange 2007 SP1

The following table lists the attributes that can be viewed on the Mail Flow Settings tab of a mail-enabled public folder object when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the Mailbox Features tab of a mailbox-enabled user or inetOrgPerson object when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the Advanced tab of mail-enabled group and dynamic distribution group objects when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the Resource Information tab of equipment or room mailbox-enabled user or inetOrgPerson objects when you use the Exchange Management Console.

The following table lists the attributes that can be viewed on the Filter and Conditions tabs of a dynamic distribution group object when you use the Exchange Management Console.

New in Exchange 2007 SP1

The following table lists the attributes that can be viewed on the Exchange General tab of mail-enabled public folder objects when you use the Exchange Management Console.

To run the Enable-Mailbox cmdlet, the account you use must be delegated the Exchange View-Only Administrator role.

The Exchange administrator must have Read and Write access to the following user or inetOrgPerson object attributes.

The administrator requires the Access Recipient Update Service extended right on the Exchange 2007 administrative group so that the task can use the Recipient Update Service to apply the appropriate address information to the object.

The administrator must also have write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Address Lists container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-AddressList cmdlet. The administrator must also have write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Recipient Policies container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-EmailAddressPolicy cmdlet.

In addition, the administrator must be able to read and modify the security permissions on the user or inetOrgPerson objects so that the task can apply the appropriate permissions for resource, shared, and linked mailboxes.

You can use the Add-ADPermission cmdlet to grant the necessary permissions in the domain and configuration partitions. For example, to grant the ability to mailbox-enable existing user objects, the following steps must be performed:

1. Run the following command to grant the OU1AdminGroup security group the ability to manage Exchange-related attributes on the user objects in the organizational unit (OU).
   
   

   Copy Code

   Add-ADPermission "OU=OUContainer1,DC=Contoso,DC=com" -User company\Admin -AccessRights ReadProperty,WriteProperty -Properties authOrig,dlMemRejectPerms,dlMemSubmitPerms,homeMDB,homeMTA,legacyExchangeDN,mail,mailNickname,mDBUseDefaults,msExchHomeServerName,msExchMailboxGuid,msExchMailboxSecurityDescriptor,msExchMailboxTemplateLink,msExchMasterAccountSid,msExchMobileMailboxPolicyLink,msExchPoliciesExcluded,msExchPoliciesIncluded,msExchRecipientDisplayType,msExchRecipientTypeDetails,msExchResourceDisplay,msExchResourceMetaData,msExchResourceSearchProperties,msExchUserAccountControl,msExchVersion,protocolSettings,proxyAddresses,publicDelegates,securityProtocol,showInAddressBook,textEncodedORAddress,unauthOrig -InheritedObjectType User -InheritanceType Descendents

2. Run the following command to grant the Admin account the ability to change the discretionary access control list of the user objects in the OU.
   
   

   	Copy Code
   Add-ADPermission "OU=OUContainer1,DC=Contoso,DC=com" -User company\Admin -AccessRights WriteDACL,ReadControl -InheritedObjectType User -InheritanceType Descendents

3. Run the following command to grant the Admin account the extended right to access the Recipient Update Service.
   
   

   	Copy Code
   Add-ADPermission -Identity "CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -InheritedObjectType ms-Exch-Exchange-Server -ExtendedRights ms-Exch-Recipient-Update-Access -InheritanceType Descendents

4. Run the following commands to grant the Admin account the ability to update the address lists and e-mail address policies.
   
   

   Copy Code

   Add-ADPermission -Identity "CN=Address Lists Container,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -AccessRights WriteProperty -Properties msExchLastAppliedRecipientFilter, msExchRecipientFilterFlags Add-ADPermission -Identity "CN=Recipient Policies,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -AccessRights WriteProperty -Properties msExchLastAppliedRecipientFilter, msExchRecipientFilterFlags

To run the Move-Mailbox cmdlet between servers that are running Exchange Server in the organization, the Exchange administrator must have the appropriate rights in the configuration partition. For more information about how to delegate the role, see How to Delegate Server Administration.

• You must be a local administrator and have the following role on the source Exchange server:
  
  
  • If the source Exchange server is running Exchange 2007, the account you use must be delegated the Exchange Server Administrator role.
    
    
  • If the source Exchange server is running Microsoft Exchange Server 2003, the account you use must be delegated the Exchange Administrator role on the administrative group where the Exchange 2003 server resides.
    
    
• You must be a local administrator and have the following permission on the target Exchange server:
  
  
  • If the target Exchange server is running Exchange 2007, the account you use must be delegated the Exchange Server Administrator role.
    
    
  • If the target Exchange server is running Exchange 2003, the account you use must be delegated the Exchange Administrator role on the administrative group where the Exchange 2003 server resides.
    
    

The administrator must be a member of the Administrators group on the local workstation or server to create a dynamic MAPI profile.

In addition, the Exchange administrator must have Read and Write access to the following user or inetOrgPerson object attributes:

• homeMDB
  
  
• homeMTA
  
  
• msExchHomeServerName
  
  
• targetAddress
  
  
• protocolSettings
  
  
• proxyAddresses
  
  

The following attributes may be modified or removed when you move a mailbox between a server that runs Exchange 2007 and a server that runs a legacy version of Exchange Server (Exchange 2000 Server or Exchange Server 2003).

You can use the Add-ADPermission cmdlet to grant the necessary permissions in the domain partition. For example, to update the attributes necessary to move the mailboxes, run the following command to grant the Admin account the ability to manage Exchange-related attributes on the user objects in the OU.

Copy Code

Add-ADPermission "OU=OUContainer1,DC=company,DC=com" -User company\Admin -AccessRights ReadProperty,WriteProperty -Properties homeMDB,homeMTA,mDBOverHardQuotaLimit,mDBOverQuotaLimit,mDBStorageQuota,msExchELCExpirySuspensionEnd,msExchELCExpirySuspensionStart,msExchELCMailboxFlags,msExchHomeServerName,msExchMailboxTemplateLink,msExchMDBRulesQuota,msExchMessageHygieneFlags,msExchMessageHygieneSCLDeleteThreshold,msExchMessageHygieneSCLJunkThreshold,msExchMessageHygieneSCLQuarantineThreshold,msExchMessageHygieneSCLRejectThreshold,msExchMobileAllowedDeviceIDs,msExchMobileDebugLogging,msExchMobileMailboxFlags,msExchMobileMailboxPolicyLink,msExchOmaAdminExtendedSettings,msExchOmaAdminWirelessEnable,msExchRecipientDisplayType,msExchRecipientTypeDetails,msExchResourceCapacity,msExchResourceDisplay,msExchResourceMetaData,msExchResourceSearchProperties,msExchUMAudioCodec,msExchUMEnabledFlags,msExchUMOperatorNumber,msExchUMPinChecksum,msExchUMRecipientDialPlanLink,msExchUMServerWritableFlags,msExchUMSpokenName,msExchUMTemplateLink,msExchUserCulture,msExchVersion,protocolSettings,proxyAddresses,targetAddress -InheritedObjectType User -InheritanceType Descendents

To run the Disable-Mailbox cmdlet against a user or inetOrgPerson object, the Exchange administrator must have the appropriate rights in the configuration partition. For more information about how to delegate the role, see How to Delegate Server Administration.

• You must be a local administrator and have the following role on the Exchange server where the mailbox resides:
  
  
  • If the Exchange server is running Exchange 2007, the account does not require any role; you only need to have the permissions defined below. However, when executing Disable-Mailbox, you will receive a warning, "Failed to commit the change on object "<Mailbox GUID>" because access is denied". This warning means that an attempt was made to immediately disable the mailbox but the action failed for some reason. Therefore, you have to wait until online maintenance does this in batch for the store in which the mailbox resides.
    
    
  • If the Exchange server is running Exchange 2003, the account you use must be delegated the Exchange Administrator role on the administrative group where the Exchange 2003 server resides.
    
    

The Exchange administrator must also have the Administer Information Store permission on the Exchange organization container. In addition, the Exchange administrator must have Read and Write access to the following user or inetOrgPerson object attributes.

You can use the Add-ADPermission cmdlet to grant the necessary permissions in the domain and configuration partitions.

For example, to disable mailboxes, you must follow these steps:

1. Run the following command to grant the Admin account the ability to manage Exchange-related attributes on the user objects in the OU.
   
   

   Copy Code

   Add-ADPermission "OU=OUContainer1,DC=Contoso,DC=com" -User company\Admin -AccessRights ReadProperty,WriteProperty -Properties altRecipient,authOrig,deletedItemFlags,delivContLength,deliverAndRedirect,displayNamePrintable,dlMemRejectPerms,dlMemSubmitPerms,extensionAttribute1,extensionAttribute10,extensionAttribute11,extensionAttribute12,extensionAttribute13,extensionAttribute14,extensionAttribute15,extensionAttribute2,extensionAttribute3,extensionAttribute4,extensionAttribute5,extensionAttribute6,extensionAttribute7,extensionAttribute8,extensionAttribute9,garbageCollPeriod,homeMDB,homeMTA,legacyExchangeDN,mailNickName,mDBOverHardQuotaLimit,mDBOverQuotaLimit,mDBStorageQuota,mDBUseDefaults,msExchELCExpirySuspensionEnd,msExchELCExpirySuspensionStart,msExchELCMailboxFlags,msExchExternalOOFOptions,msExchHideFromAddressLists,msExchHomeServerName,msExchMailboxGuid,msExchMailboxSecurityDescriptor,msExchMailboxTemplateLink,msExchMasterAccountSid,msExchMDBRulesQuota,msExchPoliciesExcluded,msExchPoliciesIncluded,msExchRecipientDisplayType,msExchRecipientTypeDetails,msExchRecipLimit,msExchRequireAuthToSendTo,msExchResourceCapacity,msExchResourceMetaData,msExchResourceSearchProperties,msExchResourceDisplay,msExchUMAudioCodec,msExchUMEnabledFlags,msExchUMOperatorNumber,msExchUMPinChecksum,msExchUMRecipientDialPlanLink,msExchUMTemplateLink,msExchUseOAB,msExchUserAccountControl,msExchUserCulture,msExchVersion,protocolSettings,proxyAddresses,publicDelegates,securityProtocol,showInAddressBook,submissionContLength,textEncodedORAddress,unauthOrig -InheritedObjectType User -InheritanceType Descendents

2. To avoid receiving the store warning mentioned above, run the following command to grant the Admin account the Administer Information Store extended right.
   
   

   	Copy Code
   Add-ADPermission -Identity "CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -ExtendedRights ms-Exch-Store-Admin -InheritanceType All

To run the Set-Mailbox, Set-UMMailbox or Set-CASMailbox cmdlet against a user or inetOrgPerson object:

• The account you use must be delegated the Exchange View-Only Administrator role.
  
  
• The Exchange administrator must have Read and Write access to the desired user or inetOrgPerson object attributes. For more information about how the Set-Mailbox, Set-UMMailbox, or Set-CASMailbox task properties map to the Active Directory attributes, see the "Mailbox-Enabled User-Related Properties" section earlier in this article.
  
  

In addition, because the Set-Mailbox, Set-UMMailbox, or Set-CASMailbox cmdlets are used to make sure that the object is assigned to the appropriate e-mail address policy, the Exchange Administrator also requires the following permissions:

• The Access Recipient Update Service extended right on the Exchange 2007 administrative group so that the task can use the Recipient Update Service to stamp the object with the appropriate address information.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Address Lists container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-AddressList cmdlet.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Recipient Policies container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-EmailAddressPolicy cmdlet.
  
  
• Read and Write access to the following attributes:
  
  
  • proxyAddresses
    
    
  • msExchPoliciesIncluded
    
    
  • msExchPoliciesExcluded
    
    
  • mail
    
    
  • textEncodedORAddress
    
    

To run the Enable-MailUser cmdlet against a user or inetOrgPerson object, the account you use must be delegated the Exchange View-Only Administrator role.

The Exchange administrator must have Read and Write access to the following user or inetOrgPerson object attributes.

In addition, the administrator requires the Access Recipient Update Service extended right on the Exchange 2007 administrative group so that the task can use the Recipient Update Service to stamp the object with the appropriate address information. The administrator must also have write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Address Lists container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-AddressList cmdlet. The administrator must also have write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Recipient Policies container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-EmailAddressPolicy cmdlet.

You can use the Add-ADPermission cmdlet to grant the necessary permissions in the domain and configuration partitions.

For example, to grant the ability to mail-enable existing user objects, the following steps must be performed.

1. Run the following command to grant the Admin account the ability to manage Exchange-related attributes on the user objects in the OU:
   
   

   Copy Code

   Add-ADPermission "OU=OUContainer1,DC=Contoso,DC=com" -User company\Admin -AccessRights ReadProperty,WriteProperty -Properties textEncodedORAddress,mail,msExchRecipientDisplayType,msExchVersion,authOrig,dLMemSubmitPerms,showInAddressBook,mailNickName,proxyAddresses,targetAddress,publicDelegates,internetEncoding,legacyExchangeDN,msExchPoliciesIncluded,msExchPoliciesExcluded,protocolSettings,unAuthOrig,dlMemRejectPerms -InheritedObjectType User -InheritanceType Descendents

2. Run the following command to grant the Admin account the extended right to access the Recipient Update Service.
   
   

   	Copy Code
   Add-ADPermission -Identity "CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -InheritedObjectType ms-Exch-Exchange-Server -ExtendedRights ms-Exch-Recipient-Update-Access -InheritanceType Descendents

3. Run the following commands to grant the Admin account the ability to update the address lists and e-mail address policies.
   
   

   Copy Code

   Add-ADPermission -Identity "CN=Address Lists Container,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -AccessRights WriteProperty -Properties msExchLastAppliedRecipientFilter, msExchRecipientFilterFlags Add-ADPermission -Identity "CN=Recipient Policies,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -AccessRights WriteProperty -Properties msExchLastAppliedRecipientFilter, msExchRecipientFilterFlags

To run the Disable-MailUser cmdlet against a user or inetOrgPerson object, the account you use must be delegated the Exchange View-Only Administrator role.

The Exchange administrator must have Read and Write access to the following user or inetOrgPerson object attributes.

You can use the Add-ADPermission cmdlet to grant the necessary permissions in the domain and configuration partitions.

For example, to grant the ability to mail-disable user objects, run the following command to grant the Admin account the ability to manage Exchange-related attributes on the user objects in the OU.

Copy Code

Add-ADPermission "OU=OUContainer1,DC=Contoso,DC=com" -User company\Admin -AccessRights ReadProperty,WriteProperty -Properties authOrig,delivContLength,displayNamePrintable,dlMemRejectPerms,dlMemSubmitPerms,extensionAttribute1,extensionAttribute10,extensionAttribute11,extensionAttribute12,extensionAttribute13,extensionAttribute14,extensionAttribute15,extensionAttribute2,extensionAttribute3,extensionAttribute4,extensionAttribute5,extensionAttribute6,extensionAttribute7,extensionAttribute8,extensionAttribute9,internetEncoding,legacyExchangeDN,mailNickname,mAPIRecipient,msExchHideFromAddressLists,msExchPoliciesExcluded,msExchPoliciesIncluded,msExchRecipientDisplayType,msExchRecipLimit,msExchRequireAuthToSendTo,msExchVersion,protocolSettings,proxyAddresses,publicDelegates,showInAddressBook,submissionContLength,targetAddress,textEncodedORAddress,unauthOrig -InheritedObjectType User -InheritanceType Descendents

To run the Set-MailUser cmdlet against a user or inetOrgPerson object, the following permissions are required:

• The account you use must be delegated the Exchange View-Only Administrator role.
  
  
• The Exchange administrator must have Read and Write access to the desired user or inetOrgPerson object attributes. For more information about how the Set-MailUser properties map to the Active Directory attributes, see the "Mailbox-Enabled User-Related Properties" section earlier in this topic.
  
  

In addition, because you must use the Set-MailUser cmdlet to make sure that the object is assigned to the appropriate E-mail Address Policy, the Exchange Administrator also requires the following:

• The Access Recipient Update Service extended right on the Exchange 2007 administrative group so that the task can use the Recipient Update Service to stamp the object with the appropriate address information.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Address Lists container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-AddressList cmdlet.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Recipient Policies container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-EmailAddressPolicy cmdlet.
  
  
• Read and Write access to the following attributes:
  
  
  • proxyAddresses
    
    
  • msExchPoliciesIncluded
    
    
  • msExchPoliciesExcluded
    
    
  • mail
    
    
  • textEncodedORAddress
    
    

To run the Enable-MailContact cmdlet on a contact object, the account you use must be delegated the Exchange View-Only Administrator role.

The Exchange administrator must have Read and Write access to the following contact object attributes:

In addition, the administrator requires the Access Recipient Update Service extended right on the Exchange 2007 administrative group so that the task can use the Recipient Update Service to stamp the object with the appropriate address information. The administrator must also have write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Address Lists container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-AddressList cmdlet. The administrator must also have write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Recipient Policies container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-EmailAddressPolicy cmdlet.

You can use the Add-ADPermission cmdlet to grant the necessary permissions in the domain and configuration partitions.

For example, to grant the ability to mail-enable existing contact objects, the following steps must be performed:

1. Run the following command to grant the Admin account the ability to manage Exchange-related attributes on the user objects in the OU.
   
   

   Copy Code

   Add-ADPermission "OU=OUContainer1,DC=Contoso,DC=com" -User company\Admin -AccessRights ReadProperty,WriteProperty -Properties displayName,textEncodedORAddress,mail,msExchRecipientDisplayType,msExchVersion,authOrig,dLMemSubmitPerms,showInAddressBook,mailNickName,proxyAddresses,targetAddress,publicDelegates,internetEncoding,legacyExchangeDN,msExchPoliciesIncluded,msExchPoliciesExcluded,protocolSettings,unAuthOrig,dlMemRejectPerms -InheritedObjectType Contact -InheritanceType Descendents

2. Run the following command to grant the Admin account the extended right to access the Recipient Update Service.
   
   

   	Copy Code
   Add-ADPermission -Identity "CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -InheritedObjectType ms-Exch-Exchange-Server -ExtendedRights ms-Exch-Recipient-Update-Access -InheritanceType Descendents

3. Run the following commands to grant the Admin account the ability to update the address lists and e-mail address policies.
   
   

   Copy Code

   Add-ADPermission -Identity "CN=Address Lists Container,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -AccessRights WriteProperty -Properties msExchLastAppliedRecipientFilter, msExchRecipientFilterFlags Add-ADPermission -Identity "CN=Recipient Policies,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -AccessRights WriteProperty -Properties msExchLastAppliedRecipientFilter, msExchRecipientFilterFlags

To run the Disable-MailContact cmdlet against a contact object, the account you use must be delegated the Exchange View-Only Administrator role.

The Exchange administrator must have Read and Write access to the following contact object attributes:

You can use the Add-ADPermission cmdlet to grant the necessary permissions in the domain and configuration partitions. For example, to grant the ability to mail-disable contact objects, run the following command to grant the Admin account the ability to manage Exchange-related attributes on the user objects in the OU.

Copy Code

Add-ADPermission "OU=OUContainer1,DC=company,DC=com" -User company\Admin -AccessRights ReadProperty,WriteProperty -Properties authOrig,delivContLength,displayNamePrintable,dlMemRejectPerms,dlMemSubmitPerms,extensionAttribute1,extensionAttribute10,extensionAttribute11,extensionAttribute12,extensionAttribute13,extensionAttribute14,extensionAttribute15,extensionAttribute2,extensionAttribute3,extensionAttribute4,extensionAttribute5,extensionAttribute6,extensionAttribute7,extensionAttribute8,extensionAttribute9,internetEncoding,legacyExchangeDN,mailNickname,mAPIRecipient,msExchHideFromAddressLists,msExchPoliciesExcluded,msExchPoliciesIncluded,msExchRecipientDisplayType,msExchRecipLimit,msExchRequireAuthToSendTo,msExchVersion,protocolSettings,proxyAddresses,publicDelegates,showInAddressBook,submissionContLength,targetAddress,textEncodedORAddress,unauthOrig -InheritedObjectType Contact -InheritanceType Descendents

To run the Set-MailContact cmdlet against a contact object, the following permissions must be granted:

• The account you use must be delegated the Exchange View-Only Administrator role.
  
  
• The Exchange administrator must have Read and Write access to the desired contact object attributes. For more information about how the Set-MailContact cmdlet properties map to the Active Directory attributes, see the "Mailbox-Enabled Contact-Related Properties" section earlier in this topic.
  
  

In addition, because the Set-MailContact task is used to make sure that the object is assigned to the appropriate e-mail address policy, the Exchange Administrator also requires the following permissions:

• The Access Recipient Update Service extended right on the Exchange 2007 administrative group so that the task can use the Recipient Update Service to stamp the object with the appropriate address information.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Address Lists container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-AddressList cmdlet.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Recipient Policies container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-EmailAddressPolicy cmdlet.
  
  
• Read and Write access to the following attributes:
  
  
  • proxyAddresses
    
    
  • msExchPoliciesIncluded
    
    
  • msExchPoliciesExcluded
    
    
  • mail
    
    
  • textEncodedORAddress
    
    

To run the Enable-DistributionGroup cmdlet against a group object, the account you use must be delegated the Exchange View-Only Administrator role.

The Exchange administrator must have Read and Write access to the following group object attributes.

In addition, the administrator requires the Access Recipient Update Service extended right on the Exchange 2007 administrative group so that the task can use the Recipient Update Service to update the object with the appropriate address information. The administrator must also have write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Address Lists container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-AddressList cmdlet. The administrator must also have write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Recipient Policies container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-EmailAddressPolicy cmdlet.

You can use the Add-ADPermission cmdlet to grant the necessary permissions in the domain and configuration partitions.

For example, to grant the ability to mail-enable group objects, you must follow these steps:

1. Run the following command to grant the Admin account the ability to manage Exchange-related attributes on the user objects in the OU.
   
   

   Copy Code

   Add-ADPermission "OU=OUContainer1,DC=Contoso,DC=com" -User company\Admin -AccessRights ReadProperty,WriteProperty -Properties authOrig,displayName,dlMemRejectPerms,dlMemSubmitPerms,legacyExchangeDN,mail,mailNickName,msExchPoliciesExcluded,msExchPoliciesIncluded,msExchRecipientDisplayType,msExchRequireAuthToSendTo,msExchVersion,proxyAddresses,publicDelegates,reportToOriginator,showInAddressBook,textEncodedORAddress,unauthOrig -InheritedObjectType Group -InheritanceType Descendents

2. Run the following command to grant the Admin account the extended right to access the Recipient Update Service.
   
   

   	Copy Code
   Add-ADPermission -Identity "CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -InheritedObjectType ms-Exch-Exchange-Server -ExtendedRights ms-Exch-Recipient-Update-Access -InheritanceType Descendents

3. Run the following commands to grant the examined account the ability to update the address lists and e-mail address policies.
   
   

   Copy Code

   Add-ADPermission -Identity "CN=Address Lists Container,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -AccessRights WriteProperty -Properties msExchLastAppliedRecipientFilter, msExchRecipientFilterFlags Add-ADPermission -Identity "CN=Recipient Policies,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -AccessRights WriteProperty -Properties msExchLastAppliedRecipientFilter, msExchRecipientFilterFlags

To run the Disable-DistributionGroup cmdlet against a group object, the account you use must be delegated the Exchange View-Only Administrator role.

The Exchange administrator must have Read and Write access to the following group attributes:

You can use the Add-ADPermission cmdlet to grant the necessary permissions in the domain and configuration partitions. For example, to grant the ability mail-disable group objects, run the following command to grant the Admin account the ability to manage Exchange-related attributes on the user objects in the OU.

Copy Code

Add-ADPermission "OU=OUContainer1,DC=Contoso,DC=com" -User company\Admin -AccessRights ReadProperty,WriteProperty -Properties authOrig,delivContLength,displayNamePrintable,dlMemRejectPerms,dlMemSubmitPerms,extensionAttribute1,extensionAttribute10,extensionAttribute11,extensionAttribute12,extensionAttribute13,extensionAttribute14,extensionAttribute15,extensionAttribute2,extensionAttribute3,extensionAttribute4,extensionAttribute5,extensionAttribute6,extensionAttribute7,extensionAttribute8,extensionAttribute9,homeMTA,internetEncoding,legacyExchangeDN,mailNickname,mAPIRecipient,msExchHideFromAddressLists,msExchExpansionServerName,msExchPoliciesExcluded,msExchPoliciesIncluded,msExchRecipientDisplayType,msExchRecipLimit,msExchRequireAuthToSendTo,msExchVersion,oOFReplyToOriginator,protocolSettings,proxyAddresses,publicDelegates,reportToOriginator,reportToOwner,showInAddressBook,submissionContLength,targetAddress,textEncodedORAddress,unauthOrig -InheritedObjectType Group -InheritanceType Descendents

To run the Set-DistributionGroup cmdlet against a group object, the following permissions must be granted:

• The account you use must be delegated the Exchange View-Only Administrator role.
  
  
• The Exchange administrator must have Read and Write access to the desired group object attributes. For more information about how the Set-DistributionGroup properties map to the Active Directory Attributes, see the "Distribution Group-Related Properties" section earlier in this topic.
  
  

In addition, because you can use the Set-DistributionGroup cmdlet to make sure that the object is assigned to the appropriate e-mail address policy, the Exchange Administrator also requires the following:

• The Access Recipient Update Service extended right on the Exchange 2007 administrative group so that the task can use the Recipient Update Service to stamp the object with the appropriate address information.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Address Lists container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-AddressList cmdlet.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Recipient Policies container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-EmailAddressPolicy cmdlet.
  
  
• Read and Write access to the following attributes:
  
  
  • proxyAddresses
    
    
  • msExchPoliciesIncluded
    
    
  • msExchPoliciesExcluded
    
    
  • mail
    
    
  • textEncodedORAddress
    
    

To run the New-DynamicDistributionGroup and Remove-DynamicDistributionGroup cmdlets against a dynamic distribution group object, the account you use must be delegated the Exchange View-Only Administrator role.

In addition, the administrator must have the following:

• Create msExchDynamicDistributionList objects permission
  
  
• Delete msExchDynamicDistributionList objects user right
  
  
• Full Control over msExchDynamicDistributionList objects
  
  
• The Access Recipient Update Service extended right on the Exchange 2007 administrative group so that the task can use the Recipient Update Service to stamp the object with the appropriate address information.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Address Lists container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-AddressList cmdlet.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Recipient Policies container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-EmailAddressPolicy cmdlet.
  
  

You can use the Add-ADPermission cmdlet to grant the necessary permissions in the domain and configuration partitions.

For example, to grant the ability to create/delete dynamic distribution group objects, the following steps must be performed:

1. Run the following command to grant the Admin account the appropriate permission to manage dynamic distribution groups in the OU.
   
   

   	Copy Code
   Add-ADPermission "ou=Container1,dc=Contoso,dc=com" -User company\Admin -AccessRights GenericAll -InheritanceType Descendents -InheritedObjectType msExchDynamicDistributionList

   To run the preceding command in Exchange 2007 SP1:
   
   

   	Copy Code
   Identity "ou=Container1,dc=Contoso,dc=com" -User "Contoso\OU1AdminGroup" -AccessRights GenericAll -ChildObjectTypes msExchDynamicDistributionList

2. Run the following command to grant the Admin account the appropriate permission to create and delete dynamic distribution groups in the OU.
   
   

   	Copy Code
   Add-ADPermission "ou=Container1,dc=Contoso,dc=com" -User company\Admin -AccessRights CreateChild, DeleteChild -ChildObjectTypes msExchDynamicDistributionList

3. Run the following command to grant the Admin account the extended right to access the Recipient Update Service.
   
   

   	Copy Code
   Add-ADPermission -Identity "CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\OU1AdminGroup " -InheritedObjectType ms-Exch-Exchange-Server -ExtendedRights ms-Exch-Recipient-Update-Access -InheritanceType Descendents

4. Run the following commands to grant the Admin account the ability to update the address lists and e-mail address policies.
   
   

   Copy Code

   Add-ADPermission -Identity "CN=Address Lists Container,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -AccessRights WriteProperty -Properties msExchLastAppliedRecipientFilter, msExchRecipientFilterFlags Add-ADPermission -Identity "CN=Recipient Policies,CN=ContosoOrg,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=Contoso,DC=com" -User "company\Admin" -AccessRights WriteProperty -Properties msExchLastAppliedRecipientFilter, msExchRecipientFilterFlags

To run the Set-DynamicDistributionGroup cmdlet against a dynamic distribution group object, the following permissions must be granted:

• The account you use must be delegated the Exchange View-Only Administrator role.
  
  
• The Exchange administrator must have Read and Write access to the desired group object attributes. For more information about how the Set-DynamicDistributionGroup properties map to the Active Directory attributes, see the "Dynamic Distribution Group-Related Properties" section earlier in this topic.
  
  

In addition, because the Set-DynamicDistributionGroup cmdlet is used to make sure that the object is assigned to the appropriate e-mail address policy, the Exchange Administrator also requires the following permissions:

• The Access Recipient Update Service extended right on the Exchange 2007 administrative group so that the task can use the Recipient Update Service to stamp the object with the appropriate address information.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Address Lists container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-AddressList cmdlet.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Recipient Policies container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-EmailAddressPolicy cmdlet.
  
  
• Read and Write access to the following attributes:
  
  
  • proxyAddresses
    
    
  • msExchPoliciesIncluded
    
    
  • msExchPoliciesExcluded
    
    
  • mail
    
    
  • textEncodedORAddress
    
    

To run the Enable-MailPublicFolder cmdlet against a public folder object, the account you use must be delegated the Exchange Public Folder Administrator role.

To run the Disable-MailPublicFolder cmdlet against a public folder object, the account you use must be delegated the Exchange Public Folder Administrator role.

To run the Set-MailPublicFolder cmdlet against a public folder object, the following permissions must be granted:

• The account you use must be delegated the Exchange Public Folder Administrator role.
  
  
• The Exchange administrator must have Read and Write access to the desired group object attributes. For more information about how the Set-MailPublicFolder properties map to the Active Directory Attributes, see the "Public Folder-Related Properties" section earlier in this topic.
  
  

In addition, because you can use the Set-MailPublicFolder cmdlet to make sure that the object is assigned to the appropriate e-mail address policy, the Exchange Administrator also requires the following:

• The Access Recipient Update Service extended right on the Exchange 2007 administrative group so that the task can use the Recipient Update Service to stamp the object with the appropriate address information.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Address Lists container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-AddressList cmdlet.
  
  
• Write access to the msExchLastAppliedRecipientFilter and msExchRecipientFilterFlags attributes on the Recipient Policies container in the Exchange organization. These permissions are required so the recipient administrator can run the Update-EmailAddressPolicy cmdlet.
  
  
• Read and Write access to the following attributes:
  
  
  • proxyAddresses
    
    
  • msExchPoliciesIncluded
    
    
  • msExchPoliciesExcluded
    
    
  • mail
    
    
  • textEncodedORAddress