Exchange Server 2010 allows an administrator to provision a new Exchange server and then delegate the actual setup of that server to another account. This is useful in scenarios such as large organizations where the Exchange administrators want to delegate the installation of Exchange to a branch site administrator or an outside contractor.
You cannot delegate the setup of the first Exchange server in the organization, but you can delegate the setup of any further Exchange servers that are being deployed.
Thanks to Exchange 2010’s Role-Based Access Control (RBAC) there is a built-in group for delegating setup of pre-provisioned servers, named the “Delegated Setup” role group. By default this group has no members.
[PS] C:\>Get-RoleGroupMember "Delegated Setup" [PS] C:\>
Add a user to this role group to allow them to install provisioned servers.
[PS] C:\>Add-RoleGroupMember "Delegated Setup" -Member paul [PS] C:\>Get-RoleGroupMember "Delegated Setup" Name RecipientType ---- ------------- Paul Cunningham User
Members of this role group can install provisioned servers but not configure or manage them. For those tasks they would also need to be added to the “Server Management” role group.
Now the new Exchange server can be provisioned by an Exchange administrator using Setup.com and the /NewProvisionedServer parameter.
[PS] C:\>setup.com /NewProvisionedServer:ex2.exchangeserverpro.local Welcome to Microsoft Exchange Server 2010 Unattended Setup Preparing Exchange Setup No server roles will be installed Performing Microsoft Exchange Server Prerequisite Check Organization Checks ......................... COMPLETED Configuring Microsoft Exchange Server Provisioning a new server ......................... COMPLETED The Microsoft Exchange Server setup operation completed successfully.
The new server has now been provisioned in Active Directory but not actually installed.
Now the account that was made a member of the “Delegated Setup” role group can deploy the new server by running Setup as normal (Note: they will still need to be a local administrator on the server to install the pre-requisites and the Exchange Server application itself).