New management scope based on database and organizational unit

Question

hi
i have some exchange 2010 SP servers and want to delegate some tasks to some other guys so wanna use RBAC
i want those guys to have some commands in an specific OU and specific databases cause in that OU there are some people with a database i do not like to be touched and also that database has some mailboxes with users in other OU's
so i want filter on both database and OU but this command does not work
New-ManagementScope -Name "Test" -RecipientRoot "domain.com/myou" -RecipientRestrictionFilter {RecipientType -eq "UserMailbox"} -DatabaseRestrictionFilter {Name -Like "db*" }
Error
Parameter set cannot be resolved using the specified named parameters.
    + CategoryInfo          : InvalidArgument: (:) [New-ManagementScope], ParameterBindingException
    + FullyQualifiedErrorId : AmbiguousParameterSet,New-ManagementScope
but when i do this separate foe each one it works
i mean this works
New-ManagementScope -Name "Test" -RecipientRoot "domain.com/myou" -RecipientRestrictionFilter {RecipientType -eq "UserMailbox"}
and also this :
New-ManagementScope -Name "Test" -DatabaseRestrictionFilter {Name -Like "db*" }
but along together, :-? the error above
what am i missing here ?
Payne is back

Answer 1

Hi,
"DatabaseRestrictionFilter" and "RecipientRestrictionFilter" parameters cannot be used together.
I recommend you refer to the following article:
http://technet.microsoft.com/en-us/library/dd335137(v=exchg.141).aspx
Parameter
Description
DatabaseRestrictionFilter
The DatabaseRestrictionFilter parameter specifies the filter to   apply to database objects. Only database objects that match the filter are   included in the scope. If you use the
DatabaseRestrictionFilter   parameter, you can't use the RecipientRestrictionFilter,
ServerRestrictionFilter,   RecipientRoot, DatabaseList, or
ServerList   parameters. For a list of filterable database properties, see
Understanding   Management Role Scopes.
RecipientRestrictionFilter
The RecipientRestrictionFilter parameter specifies the filter to   apply to recipient objects. Only recipient objects that match the filter are   included in the scope. If you use the
RecipientRestrictionFilter   parameter, you can't use the DatabaseRestrictionFilter,
DatabaseList,   ServerList, or ServerRestrictionFilter parameters. For a   list of filterable properties, see
Filterable   Properties for the -Filter Parameter.
Thanks.
Niko Cheng
TechNet Community Support
so let's do it the other way
assume John has no permission on OU A but i have created an RBAC for him to have full access on Database  DB1
Can john enable or create mailbox for a user OU A in Database DB1 ? or because he has no access (delegated permission) on that OU, he can do nothing with a user in there ?
Payne is back