Summary:  How to create a management role with ECP / OWA.  This system allows users with a tool and privileges to change AD Users' Identity, Title, Department, Company, and Manager Fields.

Issue:  Manager request to edit additional user fields from the OWA/ ECP site.  Request includes Identity, Title, Department, Company, and Manager fields.

Background:  The manager is currently assigned to the Help Desk role group that allows basic address changes to staff contact information within AD; changes to additional fields are not permitted.

Limitation:  Exchange 2010 ECP provides built-in management roles.  Editing extended role attributes are only possible with PowerShell.


Solution:

     Create AD Security Group:

1. Create a new security group in AD (e.g.  ECP_OWA-User_Fields).  Group members will have permission to edit all users' organization fields.

1. Create new management role based on Mail Recipients:
   
         New-ManagementRole -name "Mail Recipients Extended" -Parent "Mail Recipients"
2. Remove unnecessary management roles:
   
        Get-managementRoleEntry "Mail Recipients Extended\*" | where { $_.Name –ne "Set-User"} | Remove-ManagementRoleEntry
   
3.  Provide extended organization attributes (additional users' organization fields)*:
   
        Set-ManagementRoleEntry "Mail Recipients Extended\Set-User" -Parameters Identity,Title,Department,Company,Manager


4. Associate new role with Exchange Mail Recipients role:
   
        Get-managementRoleEntry "Mail Recipients\Get-*" | Add-ManagementRoleEntry -Role "Mail Recipients Extended"

Implementation allows managers (or help desk) to view and edit the organization fields for all AD users.


References:

http://www.networksteve.com/exchange/topic.php/Help_Desk_Role/?TopicId=4086&Posts=5

http://social.technet.microsoft.com/Forums/exchange/en-US/b491efb9-093d-4236-89a0-307041284765/how-to-allow-users-to-edit-title-and-department-in-ecpowa

*Additional organizational attributes:
http://technet.microsoft.com/en-us/library/ee617215.aspx

Outlook Web App distribution group management is a handy tool built into Exchange 2010.  The primary benefits allow end users to create and self manage distribution groups.  This tool can also allow help desk access to the email server to assist end users.

To enable the service, first log onto Outlook Web App, with the Administrator account.

1.  Enable “My Distribution Groups” for the default Role Assignment Policy.

A common issue that pops up is deciding which service account to use for a specific application or service .  What is the best practice for creating and using service accounts to operate Windows services and applications?

Microsoft has resolved this issue with the MSA (Managed Service Account) in Windows 2008 R2.  


     1.  Create the MSA in AD using the AD nodule for PowerShell:

          New-ADServiceAccount -Name [MSA account name] -Enabled $true

   2. Associate the MSA to a computer:

          Add-ADComputerServiceAccount -Identity [AD Computer Account] -ServiceAccount

     3.  Install the MSA on the associated computer:


          Install-ADServiceAccount -Identity [MSA Account]

     4.   Associate the new MSA with the service.

          Services.MSC → Edit Service Properties
           → Edit "Log On" Tab.

     * Use domain\MSA format
     * Do no enter a password.
   

http://technet.microsoft.com/en-us/library/dd548356(WS.10).aspx


http://blogs.technet.com/b/askds/archive/2009/09/10/managed-service-accounts-understanding-implementing-best-practices-and-troubleshooting.aspx