In Exchange 2010, by default users have permission to edit their contact information from the Exchange Control Panel. In organizations where this is unwanted, like when account information is provisioned, you need to remove these permissions.
These permissions flow from the Default Role Assignment Policy.
Note: You could have changed the default role assignment. To view the default assignment policy, check the IsDefault attribute, e.g.
Get-RoleAssignmentPolicy | Where { $_.IsDefault -eq $True }
Now, each mailbox-enabled user is assigned the default policy when created. You can verify this by inspecting the RoleAssignmentPolicy using Get-Mailbox, e.g.
The assigned roles of this policy can be viewed using Get-ManagementRoleAssignment:
The ability to edit contact information lies in the MyContactInformation. You can view a description of this role using:
Get-ManagementRole MyContactInformation | select Description
The output reads, “This role enables individual users to modify their contact information, including address and phone numbers.”
To remove this ability you have the option of removing the assignment or you can simply disable the assignment using Set-ManagementRoleAssignment, e.g.
Set-ManagementRoleAssignment -Identity "MyContactInformation-Default Role Assignment Policy" -Enabled $false
Now after logging into OWA the contact information is view-only (despite the Edit button) and the Save option is gone.
Note that after performing this step, if you want to enable contact information for some users, you need to create a new RoleAssignmentPolicy, similar to the default one but with the MyContactInformation and assign that policy to those users. For example:
New-RoleAssignmentPolicy "Default Role Assignment Policy with Info" Get-ManagementRoleAssignment -RoleAssignee "Default Role Assignment Policy" | New-ManagementRoleAssignment -Policy "Default Role Assignment Policy with Info"
You can use the same exercise to remove other unwanted functions, like the ability to create distribution groups (MyDistributionGroups) or to manage distribution group memberships (MyDistributionGroupMembership).
EighTwOne (821) 