Parameters

If you have locked down your Active Directory domain (that is, if you have disabled permission inheritance) then the domain preparation that takes place when you install Lync Server 2010 will not be able to add the rights needed to manage users, computers, contacts, application contacts, and InetOrg persons. (Domain administrators will still be able to manage these objects, but no one else, including members of the RTCUniversalUserAdmins group, will have management rights.) In that case, you will need to use the Grant-CsOUPermission cmdlet to give the required security groups the required rights. This must be done on a container-by-container basis.

Note that this cmdlet only grants rights to a set of predefined security groups; the cmdlet cannot be used to grant rights to arbitrary security groups or to individual users.

Rights granted by using Grant-CsOUPermission can later be removed by using Revoke-CsOUPermission. If you run that cmdlet, then the groups initially granted the OU rights will no longer have those Lync Server management rights for the specified Active Directory container. In that case, you will need to be an enterprise administrator or a domain administrator in order to manage Lync Server or one of its components.

Who can run this cmdlet: You must be a domain administrator in order to run the Grant-CsOUPermission cmdlet locally. To return a list of all the role-based access control (RBAC) roles this cmdlet has been assigned to (including any custom RBAC roles you have created yourself), run the following command from the Windows PowerShell prompt:

Get-CsAdminRole | Where-Object {$_.Cmdlets –match "Grant-CsOUPermission"}

None. Grant-CsOUPermission does not accept pipelined input.

Grant-CsOUPermission does not return any objects or values.

-------------------------- Example 1 ------------------------

	Copy Code
Grant-CsOUPermission -OU "ou=Redmond,dc=litwareinc,dc=com" -ObjectType "user"

The command shown in Example 1 grants user management rights (-ObjectType "user") to the Redmond OU in the domain litwareinc.com.

-------------------------- Example 2 ------------------------

	Copy Code
Grant-CsOUPermission -OU "ou=Redmond,dc=litwareinc,dc=com" -ObjectType "user","contact","inetOrgPerson"

In Example 2, management rights are granted for three different objects (user, contact, inetOrgPerson) for the Redmond OU in the domain litwareinc.com.

-------------------------- Example 3 ------------------------

	Copy Code
$x = "ou=Redmond,dc=litwareinc,dc=com", "ou=Dublin,dc=litwareinc,dc=com", "ou=Tokyo,dc=litwareinc,dc=com" foreach ($i in $x) {Grant-CsOUPermission -OU $i -ObjectType "user"}

In the preceding example, user management rights are simultaneously granted for three different OUs: Redmond, Dublin, and Tokyo. To carry out this task, the first command in the example creates an array variable named $x; this variable holds the distinguished names of the three Active Directory OUs where rights will be granted. In the second command, a foreach loop is created that takes each OU stored in the array and runs the Grant-CsOUPermission cmdlet against that organizational unit. In turn, that command grants user management rights for each OU in the array.

Other Resources