Why can't assign the applicationimpersonation in exchange 2010?

This is using MS Exchange Server 2010 with SP1, in MS Windows 2008 r2-based AD Domain. We want to assign the role - applicationimpersonation to a service account. Please see steps (powershell) we conducted as follows:

a. type - get-managementrole -roletype applicationimpersonation

result: <blank>

b. type - new-managementscope -name resourcemailboxes -recipientrestrictedfilter: recipientfilter

result: no problem

c. type - new-managementroleassignment -name resourcesimpersonation -role applicationimpersonation -user <service account> -customrecipientwritescope resourcemailboxes

result: error - The "applicationimpersonation" management role can't be found. Check the role entry name, and try again.

What's missing. Does this applicationimpersonation does not exist?

LVL 1

MichaelBalackAsked: 2017-12-07

Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

Experts Exchange Solution brought to you by

Enjoy your complimentary solution view.

Get every solution instantly with Premium. Start your 7-day free trial.

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

LVL 1

MichaelBalackAuthor Commented: 2017-12-07

There is a article to suggest to upgrade the Exchange Schema

In order to check ApplicationLmpersonation in AD, we could refer to the following steps to check:

Run “ADsiedit” in Run;
Navigate to Configuration[domainname]>service>Microsoft Exchange>domain name>RBAC>Roles;
Check if ApplicationImpersonation is in this OU.

If we didn’t find ApplicationImpersonation, we could upgrade AD schema and prepare AD domain

I checked, and this applicationimpersonation does not exist.

LVL 20

Todd NelsonSystems EngineerCommented: 2017-12-08

If you run "get-managementrole" from the Exchange Management Shell, do you see ApplicationImpersonation in the listed role types? If not, it sounds like the user you are logged into the Exchange server with is not a member of the "Organization Management" domain group.

On another note, why are you still running Exchange 2010 with SP1? Exchange 2010 SP1 hasn't been supported since the beginning of 2013.

LVL 1

MichaelBalackAuthor Commented: 2017-12-11

Hi Todd,

Yes, application Impersonation is there.

Now is upgraded to SP3.

LVL 1

MichaelBalackAuthor Commented: 2017-12-11

However, when try to run the new-mangementroleassignment, look like no permissions to do it as attached.
Impersonation.JPG

LVL 1

MichaelBalackAuthor Commented: 2017-12-11

Hi all,

Think there are few missing objects in Exchange Powershell for Exchange 2010. After applying the following 3 commands,

Add-pssnapin Microsoft*
Install-CannedRbacRoles
Install-CannedRbacRoleAssignments

Close and then re-open the Exchange Powershell, wow... the new-managementroleassignment with role - applicationimpersonation can be applied without problem.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial

LVL 20

Todd NelsonSystems EngineerCommented: 2017-12-12

How odd. Never experienced that before. Thanks for sharing your resolution.