Manage Role Based Access Control with Windows PowerShell
You can use this topic to learn how to use IPAM to manage role based access control with Windows PowerShell.
Note
For the IPAM Windows PowerShell command reference, see the IpamServer cmdlets in Windows PowerShell.
The new Windows PowerShell IPAM commands provide you with the ability to retrieve and change the access scopes of DNS and DHCP objects. The following table illustrates the correct command to use for each IPAM object.
| IPAM Object | Command | Description |
|---|---|---|
| DNS Server | Get-IpamDnsServer | This cmdlet returns the DNS server object in IPAM |
| DNS Zone | Get-IpamDnsZone | This cmdlet returns the DNS zone object in IPAM |
| DNS Resource Record | Get-IpamResourceRecord | This cmdlet returns the DNS resource record object in IPAM |
| DNS Conditional Forwarder | Get-IpamDnsConditionalForwarder | This cmdlet returns the DNS conditional forwarder object in IPAM |
| DHCP Server | Get-IpamDhcpServer | This cmdlet returns the DHCP server object in IPAM |
| DHCP Superscope | Get-IpamDhcpSuperscope | This cmdlet returns the DHCP superscope object in IPAM |
| DHCP Scope | Get-IpamDhcpScope | This cmdlet returns the DHCP scope object in IPAM |
In the following example of command output, the Get-IpamDnsZone cmdlet retrieves the dublin.contoso.com DNS zone.
PS C:\Users\Administrator.CONTOSO> Get-IpamDnsZone -ZoneType Forward -ZoneName dublin.contoso.com
ZoneName : dublin.contoso.com
ZoneType : Forward
AccessScopePath : \Global\Dublin
IsSigned : False
DynamicUpdateStatus : None
ScavengeStaleRecords : False
Setting Access Scopes on IPAM Objects
You can set access scopes on IPAM objects by using the Set-IpamAccessScope command. You can use this command to set the access scope to a specific value for an object or to cause the objects to inherit access scope from parent objects. Following are the objects that you can configure with this command.
DHCP Scope
DHCP Server
DHCP Superscope
DNS Conditional Forwarder
DNS Resource Records
DNS Server
DNS Zone
IP Address Block
IP Address Range
IP Address Space
IP Address Subnet
Following is the syntax for the Set-IpamAccessScope command.
NAME
Set-IpamAccessScope
SYNTAX
Set-IpamAccessScope [-IpamRange] -InputObject <ciminstance[]> [-AccessScopePath <string>] [-IsInheritedAccessScope] [-PassThru] [-CimSession <CimSession[]>] [-ThrottleLimit <int>] [-AsJob] [-WhatIf] [-Confirm] [<CommonParameters>]
Set-IpamAccessScope [-IpamDnsServer] -InputObject <ciminstance[]> [-AccessScopePath <string>] [-IsInheritedAccessScope] [-PassThru] [-CimSession <CimSession[]>] [-ThrottleLimit <int>] [-AsJob] [-WhatIf] [-Confirm]
[<CommonParameters>]
Set-IpamAccessScope [-IpamDhcpServer] -InputObject <ciminstance[]> [-AccessScopePath <string>] [-IsInheritedAccessScope] [-PassThru] [-CimSession <CimSession[]>] [-ThrottleLimit <int>] [-AsJob] [-WhatIf] [-Confirm]
[<CommonParameters>]
Set-IpamAccessScope [-IpamDhcpSuperscope] -InputObject <ciminstance[]> [-AccessScopePath <string>] [-IsInheritedAccessScope] [-PassThru] [-CimSession <CimSession[]>] [-ThrottleLimit <int>] [-AsJob] [-WhatIf] [-Confirm]
[<CommonParameters>]
Set-IpamAccessScope [-IpamDhcpScope] -InputObject <ciminstance[]> [-AccessScopePath <string>] [-IsInheritedAccessScope] [-PassThru] [-CimSession <CimSession[]>] [-ThrottleLimit <int>] [-AsJob] [-WhatIf] [-Confirm]
[<CommonParameters>]
Set-IpamAccessScope [-IpamDnsConditionalForwarder] -InputObject <ciminstance[]> [-AccessScopePath <string>] [-IsInheritedAccessScope] [-PassThru] [-CimSession <CimSession[]>] [-ThrottleLimit <int>] [-AsJob] [-WhatIf] [-Confirm]
[<CommonParameters>]
Set-IpamAccessScope [-IpamDnsResourceRecord] -InputObject <ciminstance[]> [-AccessScopePath <string>] [-IsInheritedAccessScope] [-PassThru] [-CimSession <CimSession[]>] [-ThrottleLimit <int>] [-AsJob] [-WhatIf] [-Confirm]
[<CommonParameters>]
Set-IpamAccessScope [-IpamDnsZone] -InputObject <ciminstance[]> [-AccessScopePath <string>] [-IsInheritedAccessScope] [-PassThru] [-CimSession <CimSession[]>] [-ThrottleLimit <int>] [-AsJob] [-WhatIf] [-Confirm]
[<CommonParameters>]
Set-IpamAccessScope [-IpamAddressSpace] -InputObject <ciminstance[]> [-AccessScopePath <string>] [-IsInheritedAccessScope] [-PassThru] [-CimSession <CimSession[]>] [-ThrottleLimit <int>] [-AsJob] [-WhatIf] [-Confirm]
[<CommonParameters>]
Set-IpamAccessScope [-IpamSubnet] -InputObject <ciminstance[]> [-AccessScopePath <string>] [-IsInheritedAccessScope] [-PassThru] [-CimSession <CimSession[]>] [-ThrottleLimit <int>] [-AsJob] [-WhatIf] [-Confirm] [<CommonParameters>]
Set-IpamAccessScope [-IpamBlock] -InputObject <ciminstance[]> [-AccessScopePath <string>] [-IsInheritedAccessScope] [-PassThru] [-CimSession <CimSession[]>] [-ThrottleLimit <int>] [-AsJob] [-WhatIf] [-Confirm] [<CommonParameters>]
In the following example, the access scope of the DNS zone dublin.contoso.com is changed from Dublin to Europe.
PS C:\Users\Administrator.CONTOSO> Get-IpamDnsZone -ZoneType Forward -ZoneName dublin.contoso.com
ZoneName : dublin.contoso.com
ZoneType : Forward
AccessScopePath : \Global\Dublin
IsSigned : False
DynamicUpdateStatus : None
ScavengeStaleRecords : False
PS C:\Users\Administrator.CONTOSO> $a = Get-IpamDnsZone -ZoneType Forward -ZoneName dublin.contoso.com
PS C:\Users\Administrator.CONTOSO> Set-IpamAccessScope -IpamDnsZone -InputObject $a -AccessScopePath \Global\Europe -PassThru
ZoneName : dublin.contoso.com
ZoneType : Forward
AccessScopePath : \Global\Europe
IsSigned : False
DynamicUpdateStatus : None
ScavengeStaleRecords : False