[This is preliminary documentation and is subject to change. Blank topics are included as placeholders.]

Modifies an existing Role-Based Access Control (RBAC). RBAC roles are used to specify the management tasks that users are allowed to carry out, and to determine the scope where users will be allowed to perform these tasks.

Syntax

Set-CsAdminRole -Identity <String> [-ConfigScopes <PSListModifier>] [-Confirm [<SwitchParameter>]] [-Force <SwitchParameter>] [-LocalStore <SwitchParameter>] [-UserScopes <PSListModifier>] [-WhatIf [<SwitchParameter>]]

Parameters

Parameter Required Type Description

Identity

Required

String

Unique identifier for the RBAC role to be modified. The Identity for an RBAC role must be the same as the SamAccountName for the Active Directory universal security group associated with that role. For example, the Help Desk role has an Identity equal to CsHelpDesk; CsHelpDesk is also the SamAccountName of the Active Directory security group associated with that role.

ConfigScopes

Optional

PS List Modifier

Used to limit the scope of the cmdlet to configuration settings within the specified site or organizational unit. To limit the cmdlet scope to a single site use syntax similar to this: -ConfigScopes site:Redmond. To limit the cmdlet scope to a single organizational unit, use syntax similar to this: -ConfigScopes "OU:ou=Redmond,dc=litwareinc,dc=com". Multiple sites or OUs can be specified by using a comma-separated list: -ConfigScopes "OU:ou=Redmond,dc=litwareinc,dc=com", "OU:ou=Dublin,dc=litwareinc,dc=com". To add new scopes (or remove existing scopes) from a role you will need to use the PowerShell list modifiers syntax. See the Examples section of this help topic for more details.

If no value is specified for this parameter then the role will have a global scope when it comes to configuration settings.

UserScopes

Optional

PS List Modifier

Used to limit the scope of the cmdlet to user management activities within the specified site or organizational unit. To limit the cmdlet scope to a single site use syntax similar to this: -ConfigScopes site:Redmond. To limit the cmdlet scope to a single organizational unit, use syntax similar to this: -ConfigScopes "OU:ou=Redmond,dc=litwareinc,dc=com". Multiple sites or OUs can be specified by using a comma-separated list: -ConfigScopes "OU:ou=Redmond,dc=litwareinc,dc=com", "OU:ou=Dublin,dc=litwareinc,dc=com". To add new scopes (or remove existing scopes) from a role you will need to use the PowerShell list modifiers syntax. See the Examples section of this help topic for more details.

If no value is specified for this parameter then the role will have a global scope when it comes to user management.

Force

Optional

Switch Parameter

Suppresses the display of any non-fatal error message that might arise when running the command.

LocalStore

Optional

Switch Parameter

WhatIf

Optional

Switch Parameter

Describes what would happen if you executed the command without actually executing the command.

Confirm

Optional

Switch Parameter

Prompts you for confirmation before executing the command.

Detailed Description

Role-Based Access control (RBAC) enables administrators to delegate control of specific management tasks in Microsoft Communications Server. For example, instead of granting help desk and support personnel full administrator privileges, you can give these employees very specific rights: the right to manage user accounts, and only user accounts; the right to manage Enterprise Voice components, and only Enterprise Voice components; the right to manage archiving and Archiving Server, and only archiving and Archiving Server. In addition, these rights can be limited in scope: someone can be given the right to manage Enterprise Voice, but only in the Redmond site; someone else can be given the right to manage users, but only if those user accounts are in the Finance OU.

The Microsoft Communications Server implementation of RBAC is based on two key elements: Active Directory security groups and Windows PowerShell cmdlets. When you install Microsoft Communications Server, a number of universal security groups - CsAdministrator, CsArchivingAdministrator, CsBranchOfficeTechnician, etc. - are created for you. These universal security groups have a one-to-one correspondence with RBAC roles; that means that any user who is in the CsArchivingAdministrator security group has all the rights granted to the CsArchivingAdministrator RBAC role. In turn, the rights granted to an RBAC role are based on the cmdlets assigned to that role (cmdlets can be assigned to multiple RBAC roles). For example, the CsArchivingAdministrator role has been assigned the following cmdlets:

Get-ArchivingPolicy

Grant-ArchivingPolicy

New-ArchivingPolicy

Remove-ArchivingPolicy

Set-ArchivingPolicy

Get-ArchivingConfiguration

New-ArchivingConfiguration

Remove-ArchivingConfiguration

Set-ArchivingConfiguration

Get-CsUser

Export-CsArchivingData

Get-CsComputer

Get-CsPool

Get-CsService

Get-CsSite

The preceding list represents the only cmdlets that an Archiving Administrator is allowed to run. If he or she tries to run, say, the Disable-CsUser cmdlet, that command will fail; that’s because Archiving Administrators do not have the right to run Disable-CsUser. This applies to the Communications Server Control Panel as well. An Archiving Administrator cannot disable a user by using the Control Panel simply because the Control Panel is aware of, and abides by, RBAC roles. (Any time you run a command in Control Panel you are actually calling a PowerShell cmdlet. If you are not allowed to run Disable-CsUser it won’t matter whether you directly run that cmdlet from Windows PowerShell or if you indirectly run the cmdlet from within the Communications Server Control Panel: the command will fail.)

Note that RBAC applies only to remote management. If you are logged on to a computer running Microsoft Communications Server and you open the Communications Server Management Shell RBAC roles will not be enforced.

When you install Microsoft Communications Server the setup program creates a dozen or so built-in RBAC roles, roles that cover such common administrative areas such as voice administration, user management, Response Group administration, and so on. These built-in roles cannot be modified in any way: you cannot add or remove cmdlets to the roles and you cannot delete these roles. (Any attempt to delete a built-in role will result in an error message.) However, you can use the built-in roles to create custom RBAC roles. These custom roles can then be modified by changing the administrative scopes; for example, you could limit the role to managing user accounts with a particular Active Directory OU.

Any custom role you create must be based on a template: an existing RBAC role. For example, to create a Dial-In Conferencing Administrator role you must effectively "clone" an existing RBAC role (for example, you might base the Dial-In Conferencing Administrator role on the existing Voice Administrator role). After the custom role has been created, you can then use Set-CsAdminRole to modify the properties of that new role.

Return Types

Set-CsAdminRole does not return a value or object. Instead, the cmdlet configures instances of the Microsoft.Rtc.Management.WriteableConfig.Settings.Roles.Role object.

Examples

-------------------------- Example 1 ------------------------

Copy Code
Set-CsAdminRole -Identity "RedmondVoiceAdministrators" -UserScopes @{Add="OU:ou=Portland,dc=litwareinc,dc=com"}

The preceding command adds a new OU (Portland) to the UserScopes property for the RBAC role RedmondVoiceAdministrators. To do this, the command includes the -UserScopes property and the following parameter value: @{Add="OU:ou=Portland,dc=litwareinc,dc=com"}. This parameter adds the OU with the distinguished name "ou=Portland,dc=litwareinc,dc=com" to the existing items already in the UserScopes property.

-------------------------- Example 2 ------------------------

Copy Code
Set-CsAdminRole -Identity "RedmondVoiceAdministrators" -UserScopes @{Remove="OU:ou=Portland,dc=litwareinc,dc=com"}

The command shown in Example 2 removes the Portland OU from the RBAC role RedmondVoiceAdministrators. To do this, the command includes the -UserScopes property and the following parameter value: @{Remove="OU:ou=Portland,dc=litwareinc,dc=com"}. This parameter deletes the OU with the distinguished name "ou=Portland,dc=litwareinc,dc=com" from the collection of items already in the UserScopes property.