Default Roles

Lync Server 2010 ships with several predefined RBAC roles. These roles exist in any deployment after the preparation steps have been completed and have a global scope. The default RBAC roles in Lync Server 2010 include the following:

• CsAdministrator—This is the equivalent of RTCUniversalServerAdmins from OCS 2007. Users assigned this role have complete control over any part of the system. They can modify the topology, manage user accounts, and create additional RBAC roles. The CS Administrators group in Active Directory is assigned this role.

• CsUserAdministrator—This role relates to the RTCUniversalUserAdmins group from OCS 2007. This role is geared toward help desk administrators and allows for enabling or disabling users for Lync. This role can also move users between pools and assign policies to accounts. The CS User Administrators group in Active Directory is assigned this role.

• CsVoiceAdministrator—Users assigned to this role can manage any of the voice features found in Lync Server 2010. This includes creation and modification of dial plans, routes, voice policies, and PSTN usages. Typically this is assigned to telephony or voice team users. The CS Voice Administrators group in Active Directory is assigned to this role.

• CsServerAdministrator—This role can manage individual Lync servers. It is geared towards users who manage, monitor, and troubleshoot Lync servers. It is slightly a step below the CsAdministrator role because no changes that globally affect the deployment, such as topology modifications, are permitted. This role typically is assigned to users who are responsible for day-to-day operations and management of Lync servers. The CS Server Administrators group in Active Directory is assigned to this role.

• CsViewOnlyAdministrator—Permits read-only access to the Lync Server deployment. This includes topology, pool, server, and user configuration, but no changes can be made. The CS View-Only Administrators group in Active Directory is assigned to this role.

• CsHelpDesk—This role is slightly more advanced than CsViewOnlyAdministrator and includes the capability to perform basic troubleshooting. This role cannot modify any user properties or assign policies as CsUserAdministrator can. The CS Help Desk group in Active Directory is assigned to this role.

• CsArchivingAdministrator—Allows for modifying the archiving policies and configuration within the organization. This role is intended for compliance or legal department users who are responsible for archiving policies. The CS Archiving Administrators group in Active Directory is assigned to this role.

• CsResponseGroupAdministrator—This role permits modification of Response Group queues, agent groups, and workflows. It is intended for users who are responsible for a small call center or the interactive voice response (IVR) systems in the organization. The CS Response Group Administrators in Active Directory is assigned to this role.

• CsLocationAdministrator—This role has the capability to modify and associate the locations and network subnets involved in E-911. The CS Location Administrators group in Active Directory is assigned to this role.