Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user.

Exchange Roles Image (Image source)

This is a great & flexible model considering how I can leverage all the benefits of PowerShell, while using the right low level technologies (WCF, SOAP etc), and requiring no additional software on the client side.

image of how Exchange 2010 remote admin works (Image source)


  1. Is there a way for me to leverage Exchange's delegation model in my .NET application?

  2. Has anyone attempted to imitate this model?

  3. If I must start from scratch, how would I go about imitating this approach?

share|improve this question

migrated from Mar 17 '12 at 6:50

This question came from our site for professional and enthusiast programmers.

Did you make any progress with this? I'm especially curious about how to implement the 'recipient/configuration with scope' part of the model. – Jacco May 21 '12 at 8:38

The two largest RBAC for .NET are NetSqlAzMan and RhinoSecurity

If you end up having to go the route of starting from scratch, you could use either of the above as a starting base.

share|improve this answer

Exchange is providing a constained runspace, and there aren't actually any cmdlets available in that runspace. What appear to be cmdlets are actually proxy functions. Your capabilities in the runspace are controlled by limiting what proxy functions are provided, and what capabilites of each cmdlet are exposed by the proxy function.

Duplicating that would involve developing a routines that populate the runspace with proxy functions tailored to the user requesting the runspace, based on the role groups they belong to. I don't see any reason AD groups couldn't be as your role groups.

Implementation details would be application specific, but basically it means that you limit who can use which parameters of the cmdlets by choosing which parameters the proxy functions provided to that user will have and/or limiting what values the function will accept for particular parameters.

share|improve this answer
That makes sense; do you have more information on how I can create such a proxy function? I can figure out the AD / AzMan piece. – LamonteCristo Feb 22 '12 at 15:58
See if this helps:… – mjolinor Feb 22 '12 at 16:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.