Customizing Default Role Assignment Policy So That Users Can’t Create Or Delete Distribution Groups, But Can Modify…

Share & Comment

One question I got in response to my article “Group owners cannot manage distribution groups once migrated from Exchange 2003 to 2010” was the steps required to tweak the default role assignment policy so that the owners can modify the groups, but users cannot create or delete distribution groups.

Let me explain the steps required, which have to be done in the Shell. The permissions to create/modify/delete distribution groups are in the default role named “MyDistributionGroups”. Hence, all we need to do is to take away the role entries which gives users right to create and delete a distribution group (New & Remove-DistributionGroup cmdlets). But, we don’t want to mess with the default roles and hence we will create a new role which is a child of “MyDistributionGroups”. I will name it OwnersCanModifyDistributionGroups.

Run the command below in the Shell to create the role.

New-ManagementRole -Name OwnersCanModifyDistributionGroups -Parent MyDistributionGroups

Create a new management role

Now we need to remove the new & remove-distributiongroup cmdlets from the management role. Run the following in the Shell.

Remove-ManagementRoleEntry OwnersCanModifyDistributionGroupsNew-DistributionGroup

Remove right to create a DG

Remove-ManagementRoleEntry OwnersCanmodifyDistributionGroupsRemove-DistributionGroup

Remove right to delete DG

Now that the custom role is ready, we need to add it to the default role assignment policy. This assumes that you don’t have “MyDistributionGroups” role in the policy. If you have, you need to delete it. Easiest is to use the ECP & remove the check box (follow my article mentioned in the beginning) if you are not comfortable with Shell. Run the command below to add the role to the default policy.

New-ManagementRoleAssignment -Role OwnersCanModifyDistributionGroups -Policy "Default Role Assignment Policy"

Add the new role to default policy

That’s it. Users can now modify the distribution groups they own, but can’t create or remove distribution groups.

Share & Comment
Subscribe for Updates
Never miss a blog post again
About the author: UC Architect, Blogger, Husband & Dad. I have been in IT for the last 12 years, with Exchange Server becoming the prime area in the last few years. I am active on Experts Exchange & TechNet forums and I am a technical author for SearchExchange.

2 comments… add one

  1. Nehru Moorthi

    Nice article, Saved me from following the steps at

    Thank you Rajith

    1. Rajith Jose Enchiparambil

      Glad that you found the article helpful Nehru.

Leave a Comment