I have a basic question, I have some admins that have domain admin access, we're working on removing that.  In our new Exchange 2013 build I want to limit their access to only very basic Exchange roles.  Will they be able to override the permissions I set because they are domain admins?

I have a feeling I know the answer to this but I'm looking for confirmation.

Thanks,

Matt

Hello

yes. from aduc add own user to Organization Management and user admin on exch.

Hi Matt,

Thank you for your question.

What is permission which will be overridden?

We suggest we create RBAC for those domain administrator to have Exchange permission by the following link:

https://technet.microsoft.com/en-us/library/dd298183(v=exchg.150).aspx

If there are any questions regarding this issue, please be free to let me know. 

Best Regard,

Jim

Will they be able to override the permissions I set because they are domain admins?

Yes. RBAC only work if you use Exchange to manipulate Exchange objects or attributes, when you start the EAC or EMS, you ask actions to Exchange that validate them against RBAC and then do the action on AD using Exchange Trusted Subsystem.

If your user change objects or attributes in AD using tools like ADSIEdit, RBAC won't block them, only AD permissions.