Microsoft KB Archive/296260

From BetaArchive Wiki

Article ID: 296260

Article Last Modified on 2/27/2007


APPLIES TO

  • Microsoft Windows 2000 Service Pack 1
  • Microsoft Windows 2000 Service Pack 2
  • Microsoft Exchange 2000 Server Standard Edition
  • Microsoft Exchange 2000 Enterprise Server
  • Microsoft Exchange Server 5.5 Service Pack 3
  • Microsoft Exchange Server 5.5 Service Pack 4


This article was previously published under Q296260

SUMMARY

This article describes how to create a two-way Recipient Connection Agreement to replicate an Exchange Server 5.5 directory to a Windows 2000 domain.

MORE INFORMATION

In Exchange 2000 Server, unlike Exchange Server 5.5, a mailbox is an attribute of an object in Active Directory, not an object itself. Therefore, each user object in Active Directory can only be matched to one mailbox. For every mailbox that exists in the information store, a matching user account must exist in Active Directory.

Before you use the Active Directory Connector (ADC) to replicate mailboxes from Exchange Server 5.5 to Active Directory, you must identify and mark mailboxes that are associated with the same Microsoft Windows NT account. For additional information about how to identify and mark mailboxes that are associated with the same Windows NT account, click the article number below to view the article in the Microsoft Knowledge Base:

274173 XADM: Documentation for the NTDSNoMatch Utility


Before You Install the Active Directory Connector and Configure Recipient Connection Agreements

In most ADC deployments, your configuration falls under one of the following scenarios; before you configure Recipient Connection Agreements, determine which scenario applies to your situation:

  • First scenario. The Exchange Server 5.5 mailboxes are associated with accounts in a Windows 2000 Active Directory domain.
  • Second scenario. The Exchange Server 5.5 mailboxes are associated with accounts that are located in a Windows NT 4.0 domain, even though a new Windows 2000 Active Directory domain has been created.

In both scenarios, you need to install the ADC. To install the ADC:

  1. Log on to the Windows 2000 domain controller as a member of the Domain Administrators, Enterprise Administrators, and Schema Administrators groups.
  2. Insert the Exchange 2000 Server CD-ROM in the CD drive.
  3. Click Start, click Run, and then type CD-ROM drive:\adc\setup.exe.
  4. In the Welcome dialog box, click Next.
  5. Click to select the Microsoft Active Directory Connector Service and Microsoft Active Directory Connector Management check boxes, and then click Next.
  6. When Setup is complete, click Finish.

For additional information about how to configure the ADC, click the article number below to view the article in the Microsoft Knowledge Base:

253286 XADM: ADC Installation Requirements


First Scenario

To configure the two-way Recipient Connection Agreement:

  1. On the Start menu, point to Programs, point to Administrative Tools, and then click Active Directory Connector Management.
  2. Right-click Active Directory Connector, point to New, and then click Recipient Connection Agreement.
  3. Click the General tab, and then:
    1. Type the name of the Recipient Connection Agreement in the Name box.
    2. Under Replication Direction, click Two-way.
    3. When you receive the following message, click OK:

      The Recipient Connection Agreement must now write to the Exchange directory.

    4. Click the Active Directory Connector server that you want to use.

      NOTE: If this is the first installation, there is only be one server available.
  4. Click the Connections tab, and then:
    1. Under Windows Server Information:
      1. Make sure that:
        • The Server box contains the name of your Windows 2000-based server.
        • The Authentication box defaults to "Windows Challenge/Response".
        • The account that you are using has write permissions to the directory because the agreement is a two-way agreement, and read and write permissions are necessary.
      2. Under Connect as, click Modify, and then select an Administrative account that has write permissions to Active Directory.
    2. Under Exchange Server Information:
      1. Make sure that:
        • The Server box contains the name of your Exchange Server 5.5 computer.
        • The Authentication box defaults to "Windows Challenge/Response".
        • The account that you are using has at least Admin permissions to the directory because the agreement is a two-way agreement, and read and write permissions are necessary.
        • The Lightweight Directory Access Protocol (LDAP) port on the Exchange Server 5.5 directory is correct (by default, this port is 389).
      2. In the Connect as list, click Modify, and then select an account that has Admin privileges in the Exchange Server 5.5 directory.
  5. Click the Schedule tab, and then set the Replication time to Always.

    NOTE: The ADC automatically replicates all of the objects during the first replication cycle; therefore, if you select the Replicate the entire directory the next time the agreement is run check box, you do not affect the first replication cycle.
  6. Click the From Exchange tab, and then:
    1. Under Exchange Recipients containers, click Add, and then add each top-level Recipients container from your Exchange Server 5.5 site.

      IMPORTANT: Do not add any containers from other sites. If you use multiple sites, you need to set up additional two-way Recipient Connection Agreements to servers in each of the other sites.
    2. Under Default destination, click Modify, and then click the Users container.

      NOTE: This is the default container in which the ADC will create new objects if the ADC cannot match the Exchange Server 5.5 object to an existing Active Directory object. If user accounts exist in different organizational units, see the IMPORTANT note in step 6.c.
    3. Make sure that all of the objects under Select the objects that you want to replicate are selected (all of the objects are selected by default).

      IMPORTANT: The ADC replicates all of the Exchange Server distribution lists (DLs) to Active Directory as Universal Distribution Groups (UDGs). You can create these UDGs in either a mixed-mode or native-mode Active Directory domain. However, if you use the equivalent Exchange Server DL object to control access to public folders in Exchange Server, the Exchange 2000 information store process tries to convert the UDG to a Universal Security Groups (USG) because distribution groups are not security principals. If the UDG exists in a mixed-mode Active Directory domain, the USG conversion process does not succeed because USGs can only exist in native-mode domains. This results in a public folder in Exchange 2000 that has an ambiguous Access Control List (ACL); because of this, only the folder owner can access the folder's content, and other Exchange 2000 users cannot even see the public folder in the client hierarchy. When a UDG-to-USG conversion does not succeed, a 9552 event ID message is logged in the Exchange 2000 Application event log. In this scenario, you need a separate Recipient Connection Agreement to replicate the DLs to a native-mode domain.
  7. Click the From Windows tab, and then:
    1. Under Windows Organizational Units, click Add, and then add the Users container.

      IMPORTANT: If the Active Directory domain contains additional organizational units that contain users with Exchange mailboxes, you must specify these organizational units under Windows Organizational Units. If you do not specify the organizational units as export containers, the ADC cannot replicate the users back to the Exchange Server 5.5 directory.
    2. Under Default destination box, click Modify, and then click the appropriate Recipients container.
    3. Make sure that all of the objects under Select the objects that you want to replicate box are selected (all of the objects are selected by default).
    4. Click to select the Replicate secured Active Directory objects to the Exchange directory check box. Secured Active Directory objects are Active Directory objects that contain an explicit Deny Access Control Entry (ACE).
    5. Determine whether or not you want to select the Create objects in location specified by Exchange 5.5 DN check box. If you select this check box, the ADC creates new objects in a location that is based on the Exchange Server 5.5 distinguished name (legacyExchangeDN). If the organizational units that you selected as export containers contain subcontainers, you can select this check box to prevent the ADC from creating these subcontainers in the Exchange Server 5.5 directory.For additional information about subcontainer replication, click the article number below to view the article in the Microsoft Knowledge Base:

      253826 XADM: How Active Directory Connector Replicates Subcontainers

  8. Click the Deletions tab.For additional information about which options to select on the Deletions tab, click the article number below to view the article in the Microsoft Knowledge Base:

    253829 XADM: Description of the Active Directory Connector Deletion Mechanism

  9. You are now finished configuring the Recipient Connection Agreement. To force replication, right-click the two-way agreement, and then click Replicate Now.

Second Scenario

This scenario describes how to create a two-way recipient Connection Agreement between an Exchange Server 5.5 computer that is running in a separate Windows NT 4.0 domain and a new Windows 2000 Active Directory domain. This scenario requires at least a one-way trust relationship in which Windows 2000 Active Directory trusts the Windows NT 4.0 domain. However, to ease administrative effort, a two-way trust relationship is recommended.

IMPORTANT: if your migration strategy is to have users log on to your newly-created Active Directory, then you can run the ADMT before you create your two-way recipient Connection Agreement. If you run a domain migration tool that migrates SidHistory such as ADMT before you create your two-way recipient Connection Agreement, you do not have to run the ADClean Utility. ADMT settings allow the Administrator to create enabled users with which a valid 5.5 mailbox can match.

To create a two-way recipient Connection Agreement between an Exchange Server 5.5 computer that is running in a separate Windows NT 4.0 domain and a new Windows 2000 Active Directory domain:

  1. Perform all of the steps in the "First Scenario" section of this article.
  2. Start the Windows 2000 Active Directory Users and Computers snap-in, and then confirm that Exchange Server 5.5 users have been replicated as disabled users. Note that these objects are located in the default import container that is specified on the From Exchange tab of the Recipient Connection Agreement.

    IMPORTANT: Do not enable these disabled users. These accounts are only place holders for the Exchange Server 5.5 mailboxes; these accounts are not security principals, and are not meant to be logged on to.
  3. Determine which one of the following methods you want to use to migrate your user accounts to Windows 2000 Active Directory:
    • Upgrade the Windows NT 4.0 domain to Windows 2000.
    • Use the Active Directory Migration Tool (ADMT) to migrate users, including SidHistory.For additional information about how to use ADMT to migrate users, click the article number below to view the article in the Microsoft Knowledge Base:

      260871 How to Set Up ADMT for Windows NT 4.0 to Windows 2000 Migration

    • Use a third-party migration utility that supports SidHistory migration.
  4. After you migrate the users to Windows 2000 Active Directory, you can run the Active Directory Cleanup Wizard (ADClean) to merge the mail attributes from the ADC-created place holder accounts with your newly migrated users.For additional information about the Active Directory Account Cleanup Wizard, click the article number below to view the article in the Microsoft Knowledge Base:

    270652 XADM: Possible Uses of Active Directory Account Cleanup Wizard



Additional query words: ca

Keywords: kbhowto KB296260



Send feedback to Microsoft

© Microsoft Corporation. All rights reserved.


Retrieved from ‘https://www.betaarchive.com/wiki/index.php?title=Microsoft_KB_Archive/296260&oldid=162062’
the Creative Commons 3.0 ShareAlike (except the Microsoft KB Archive).
Powered by MediaWiki