Symptoms
Assume that you create a role assignment policy for the Active Directory permissions role with a scope that limits permissions of the cmdlets to the organizational unit that is specified in Microsoft Exchange Server 2013. The Add-ADPermission and Remove-ADPermission cmdlets can be run against any user object unexpectedly, even if the user object is outside the management scope. Note The Add-ADPermission and Remove-ADPermission cmdlets can check whether the user who is being updated is within the management scope for the account that is running the cmdlet.
Resolution
To resolve this issue, install Cumulative Update 7 for Exchange Server 2013.
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
More Information
For more information about the Add-ADPermission cmdlet, see the general information about Add-ADPermission.For more information about the Remove-ADPermission cmdlet, see the general information about Remove-ADPermission.
