SMART Directory Sync 4.5. Comprehensive User Guide for AD Migration/Synchronization and Exchange Migration

Transcription

1 SMART Directry Sync 4.5 Cmprehensive User Guide fr AD Migratin/Synchrnizatin and Exchange Migratin February 2016

2 Table f Cntents Sectin 1. Intrductin Purpse Audience fr AD Migratin/Synchrnizatin and Exchange Migratin Abut SMART Directry Sync fr AD Migratin/Synchrnizatin and Exchange Migratin... 4 Sectin 2. Cnfiguring AD Migratin/Synchrnizatin and Exchange Migratin Synchrnizatin Prfiles Applying a License Adding an AD Migratin/Synchrnizatin Prfile Adding an Exchange Migratin Synchrnizatin Prfile Imprting and Exprting a Prfile Suspending and Activating a Prfile Remving a Prfile Resetting a Prfile Sectin 3. Running Sync Reprts Sectin 4. Running Directry Sync Manually Starting a Synchrnizatin using a Sync Prfile Manually Starting a Synchrnizatin Prcess using the Right-Click Menu Manually Starting a Synchrnizatin Prcess frm a Cmmand Line Sectin 5. Using the SMART Directry Sync Lg Viewer t View Lgs and Audits Searching Lg r Audit Entries Pausing a Lg Shwing Lg r Audit Entries fr a Time Perid Filtering the Lg r Audits Gruping the Lg r Audits by Clumn Viewing Lg r Audit Entry Details Exprting Lg r Audit Entries Clearing Lg Entries Sectin 6. Updating the Grups t Ignre List in SQL Default List f Grups in the Grups t Ignre List Members fr Active Directry Synchrnizatin Updating the Grups t Ignre List with the SQL Server Management Studi (SSMS) Updating the Grups t Ignre List with the SQL Imprt and Exprt Tl Excluding Security Grups frm Synchrnizatin with the Grup Filter

3 Appendix A: Supprting a Mixed Exchange 2003/ 2007/2010/2013/2016 Envirnment Appendix B: Additinal Cnfiguratin Optins Appendix C. Using the User, Grup, and Device LDAP filters Appendix D: Default Mapping Appendix E: Custmizing Overrides Appendix F: Directry Sync Fields with Special Prcessing Abut Binary Tree

4 Sectin 1. Intrductin 1.1 Purpse The purpse f this dcument is t prvide infrmatin n hw t use Binary Tree SMART Directry Sync t perfrm synchrnizatins frm a surce t a target Active Directry. 1.2 Audience fr AD Migratin/Synchrnizatin and Exchange Migratin It is assumed the reader has the fllwing technical expertise: Advanced Active Directry & Exchange Administratin Windws Administratin SQL Administratin LDAP SMTP Ruting DNS 1.3 Abut SMART Directry Sync fr AD Migratin/Synchrnizatin and Exchange Migratin SMART Directry Sync allws yu t synchrnize bjects frm a surce t a target Active Directry. Directry Sync has been carefully design and crafted t meet the challenging requirement fr a slutin that can deliver a reliable, secure, and autmated slutin that synchrnizes and transfrms directry data between Active Directry envirnments supprting Exchange 2003, 2007, 2010, 2013, and Key Features and Functins Sync Reprts allw yu t view hw bjects will appear in the target directry befre synchrnizing a prfile. This allws fr the remediatin f data issues withut impacting the target directry. Synchrnize user bjects frm a surce Active Directry t a target Active Directry Synchrnize bjects As-is, as Cntacts, as mail-enabled users r as disabled mail-enabled users Custmizable attribute matching lgic Synchrnize Active Directry grups and distributin lists frm a surce Active Directry t a target Active Directry Three Cnflict Reslutin ptins fr grup and distributin list synchrnizatin Skip the bject 4

5 Rename the bject Merge the surce members int the Distributin List in the target Active Directry Three Cllisin ptins fr User bject synchrnizatin Skip the bject Rename the bject Update the bject Ability t mail-enable matched users in the target Active Directry Custmizable attribute mapping table Intra-Frest and Inter-Frest migratin and synchrnizatin sidhistry and Passwrd Synchrnizatin is available in the AD Migratin/Synchrnizatin prfile type* *AD Migratin/Synchrnizatin prfile type may require additinal licensing. 5

6 Sectin 2. Cnfiguring AD Migratin/Synchrnizatin and Exchange Migratin Synchrnizatin Prfiles The SMART Directry Sync Cnsle prvides an easy t fllw wizard fr creating directry synchrnizatin prfiles between Active Directries. It als allws yu t quickly manage prfiles and immediately start synchrnizatin. T begin cnfiguring the synchrnizatin, start the installed SMART Directry Sync Cnsle. 2.1 Applying a License All SMART Directry Sync prfile types are licensed fr the number f bjects t be synchrnized. Sme ptins are either enabled r disabled (fr example, Grup migratin). A license key must be added in rder t synchrnize bjects t a Target. T apply a license: 1. On the SMART Directry Sync Cnsle, click the License buttn. The License dialg windw appears. 2. Click the Apply License buttn. 3. Brwse t and select the license (.lic) file btained frm Binary Tree, and then click Open. 4. The license details appear in the dialg windw. Click Clse t clse the windw. 6

7 2.2 Adding an AD Migratin/Synchrnizatin Prfile The SMART Directry Sync AD Migratin/Synchrnizatin prfile is used fr bth AD t AD directry synchrnizatin and in supprt f an Active Directry migratin utilizing Binary Tree s SMART Active Directry Migratr prduct. T add an AD Migratin/Synchrnizatin prfile: 1. On the Prfiles tab, click Add Prfile. 2. In the Prfile Type Selectin windw, select AD Migratin/Synchrnizatin and then click OK. The fllwing Prfile Types are als available: Exchange Migratin used in supprt f an Exchange migratin utilizing Binary Tree s E2E Cmplete prduct. Active Directry t Dmin Directry used t synchrnize bjects frm an Active Directry surce t a Dmin directry target. Dmin Directry t Active Directry used t synchrnize bjects frm a Dmin directry surce t an Active Directry target. Windw Server Migratin used in supprt f a Windws Server migratin utilizing Binary Tree s Windws Server Migratin prduct. 7

8 3. A new pane appears at the bttm f the cnsle which prvides the ability t cnfigure ptins fr synchrnizatin. 4. On the General tab, enter a name t identify the prfile in the Name field. 5. Select the scpe f the prfile frm the Scpe drp-dwn list: Inter-Frest (default) will synchrnize dmains in different frests. Intra-Frest will synchrnize dmains within a frest. If selected, the Add x500 Prxy t Surce and Resurce Frest ptins must be set t N and msexch mappings are invalid. Befre the prfile can be saved with Intra-Frest chsen as the scpe, the mappings fr all f the msexch attributes will need t be remved. 6. Select the status f the prfile frm the Status drp-dwn list: Active will synchrnize manually r as scheduled as sn as the prfile is saved Suspended Nt active, will nt synchrnize 7. Select the lgging level f the prfile frm the Lgging drp-dwn list: Lw nly errrs are lgged Medium errrs and warnings are lgged High all messages (errrs, warnings, infrmatin, etc.) are lgged (shuld be used fr trubleshting purpses nly) 8. Select an Audit Lgging ptin frm the drp-dwn list: Enabled Recrds bject and attribute changes in the Audit Lg Disabled Object and attribute changes will nt be recrded in the Audit Lg 8

9 9. Fr Schedule, select the schedule: By frequency enter the apprpriate frequency r the specific time fr the synchrnizatin prcess t run fr yur envirnment. Zer (0) is nt a valid value fr frequency. The minimum interval is 15 minutes. At specific times(s) enter ne r mre specific times r select times frm the drp-dwn list f times. A selected time can be deleted by selecting the time and clicking the Delete key. Manual nly the synchrnizatin prcess will nt run until it is manually started. If yu chse the By frequency ptin, SMART Directry Sync will initiate a synchrnizatin when an active prfile is saved. Select the At specific time(s) ptin and select a time in the future r select the Manual nly ptin if yu want t save an active prfile withut it syncing right away. This wuld be helpful if yu wanted t run a Sync Reprt r inspect items in SQL befre pulling them int the target Active Directry. 10. Click the AD Surce tab enter credentials that have read/write access t the surce Active Directry. The required read access must extend t the Deleted Accunts cntainer, which can require a privileged accunt. 11. In the User Name field, enter the Active Directry User Name. The credential shuld be entered as a user principal name (fr example, jsmith@acmecrp.cm) 12. In the Passwrd field, enter the passwrd assigned t the Active Directry user. 9

10 13. In the Glbal Catalg Server field, enter the IP Address r fully qualified dmain name f the server (FQDN) fr the Glbal Catalg Server r a Dmain Cntrller that will be used fr all read/write peratins. The entered credentials and Glbal Catalg Server/Dmain Cntrller must have access t all Dmains and subdmains that are required t synchrnize. If SID Histry will be synchrnized, SMART Directry Sync will require access t the dmain cntrller hlding the PDC Emulatr Active Directry FSMO rle in all surce and target dmains. 14. Select an Attribute Change Detectin ptin frm the drp-dwn list: Enabled Only attributes changed n the surce bject will be synchrnized Disabled All attributes n the surce bject will be synchrnized 15. Select an Autmatically Mark Objects as Ready t Sync ptin frm the drp-dwn list: N (default) Objects are nt marked as Ready t Sync. N shuld be selected if yu are using SMART AD Migratr t perfrm an AD migratin. Objects can be marked as ready t sync in the SMART AD Migratr Cnsle. Yes Objects are marked as Ready t Sync. Objects will be synced during the synchrnizatin. Yes shuld be selected if yu are perfrming an AD t AD directry synchrnizatin and nt a full AD migratin. 16. Click Add OU(s) t display a list f OU(s) (rganizatinal units) available t synchrnize. Nte that a synchrnizatin prfile that includes the OU where the cmputer bjects reside shuld be created. 17. Select the apprpriate surce OU s and click OK. The selected surce OUs are displayed in the Surce OUs table. 10

11 T deselect an OU frm the surce, select it and then click the Remve OU buttn and cnfirm r click the Delete key. 18. The fllwing Surce OU fields display at the bttm f the screen used in the abve example. Surce OU Reflects the OU selected frm the tree view. Sub OUs Select this ptin t synchrnize Sub-OUs. The checkbx is selected by default. Clear this ptin if yu d nt want t synchrnize sub-ous. Grups The checkbx is selected by default. Clear this ptin t skip grups frm being synchrnized. Disabled Users Select this ptin t synchrnize Disabled Users. The checkbx is selected by default. Clear this ptin t prevent Disabled Users frm being synchrnized. Nn-Mail Enabled Select this ptin t synchrnize Nn-mail enabled bjects. The checkbx is nt selected by default. Clear this ptin t skip Nn-mail enabled bjects frm being synchrnized. User Filter This is an LDAP filter and can be used t filter synchrnizatin t specific bject types r thse bjects exhibiting specific attribute prperties. See the Using the User, Grup, and Device LDAP Filter tpic fr mre infrmatin. Grup Filter This is a LDAP filter and can be used t filter grups based n the entered criteria. See the Using the User, Grup, and Device LDAP Filters tpic fr mre infrmatin. Device Filter This is a LDAP filter and can be used t filter devices based n the entered criteria. See the Using the User, Grup, and Device LDAP Filters tpic fr mre infrmatin. It is recmmended that yu test the LDAP filter syntax prir t saving yur changes and running a synchrnizatin. 19. Click the Surce DCs tab t define the list f Surce Dmain Cntrllers (DCs) used fr synchrnizatin. 11

12 20. Click Add DC(s) t pen the Active Directry DC Selectin windw. Click Refresh DCs t find all available Dmain Cntrllers. Available ptins include Ping Servers t test the availability f the selected Dmain Cntrllers and Test Cnnectins t test the cnnectin t the LDAP server. Select ne r mre Dmain Cntrller and click OK t add the Dmain Cntrllers t the list f Surce DCs. If yur Active Directry frest cntains mre than ne dmain it may be necessary t add at least ne dmain cntrller frm each dmain. When SMART Directry Sync attempts t reslve bjects, such as grup members r a user's manager, that are in anther Dmain (than the ne specified n the Surce tab), it will reference the dmain cntrllers list t find a valid DC t use. T ensure that grup membership and manager/subrdinate relatinships are prperly recreated, it is recmmended t add the apprpriate DC s fr alternate dmains t the Surce DC s tab. 12

13 21. The Active Directry DC Selectin windw clses and the selected Dmain Cntrllers appear in the Surce DC s list. The rder the dmain cntrllers are used fr each Dmain can be selected by entering a number value in the Pririty clumn (lwest number = first). If the highest pririty DC is unavailable, Directry Sync will use the next DC. Dmain Cntrllers with n pririty set will be used after thse with a pririty. If n pririty is set fr the servers in a Dmain, they will be used in the rder listed in the table. A Dmain Cntrller that is the Glbal Catalg Server selected n the AD Surce tab is given tp pririty regardless f the value in the Pririty field. N tw DC s in a Dmain can have the same pririty. 22. Click the AD Target tab. 23. In the User Name field, enter the name f the Active Directry user that has the required rights t the Target directry. The credential shuld be entered as a user principal name (fr example, jsmith@acmecrp.cm) 24. In the Passwrd field, enter the passwrd f the Active Directry user. These credentials shuld have write access t target OU, as well as Dmains r subdmains that may cntain matched users. 13

14 25. In the Glbal Catalg Server field, enter the IP Address r fully qualified dmain name f the server (FQDN) f the Glbal Catalg Server r Dmain Cntrller that will be used fr all write peratins. 26. In the Target OU, Click Brwse t select a target OU. Any newly created bjects will be written t this OU. 27. Check the D nt create surce OUs in target ptin if yu d nt want the surce OU structure t be created as bjects are synchrnized t the target. All bjects will be created directly in the Target OU specified fr that prfile. 28. Select an ptin frm the Synchrnize Passwrds drp-dwn list: N (default) Passwrds will nt be cpied t the target Yes Passwrds will be cpied t the target. The passwrd plicy n the surce must meet r exceed the passwrd plicy strength n the target. An errr will ccur if the Administratr passwrd cntains duble qutes (") when perfrming passwrd synchrnizatin. T wrk arund this, ensure the administratr passwrd des nt cntain duble qutes. 29. Enter a default passwrd fr new users in the Default Passwrd field. The default passwrd cannt exceed 128 characters in length. Even if Passwrds are being cpied, and default passwrd value is still required as the initial accunt is created with the default passwrd, and then the surce passwrd is cpied ver. 30. Select an ptin frm the Preserve Objects in Target drp-dwn list t cntrl what happens t target bjects when the crrespnding surce bjects are deleted: N (default) When bjects are deleted in the surce, the crrespnding bjects will be deleted frm the target. This nly applies t bjects created in the target by SMART Directry Sync. Yes Objects that are deleted in the surce will nt be deleted in the target. 31. Select an ptin frm the Preserve Deleted Objects in Target As Is drp-dwn list t cntrl what happens t target bjects if they are deleted: N (default) If an bject previusly synchrnized is deleted n the target, it will be recreated. Yes If an bject previusly synchrnized is deleted n the target, it will nt be recreated. 32. Click the AD Target Optins tab. 14

15 33. Click the Users sub-tab. 34. Select an ptin frm the Create Mail Enabled Users as drp-dwn list: Fr Inter-Frest: As Is (default) Mail-Enabled Users in the surce will be Mail-Enabled Users in the target Mailbx-Enabled Users in the surce will becme Mail-Enabled Users in the target The Active Directry User Accunt Cntrl prperty fr enabled r disabled will be cpied as is. In ther wrds, user accunts that are enabled in the surce, will be enabled in the target. Mail-Enabled Cntacts in the surce will be Mail-Enabled Cntacts in the target Mail-Enabled, AD Enabled The Active Directry User Accunt Cntrl prperty fr enabled r disabled will always be set t Enabled. In ther wrds, user accunts that are disabled in the surce, will be enabled in the target Mail-Enabled Users in the surce will be Mail-Enabled Users in the target Mailbx-Enabled Users in the surce will becme Mail-Enabled Users in the target Mail-Enabled Cntacts in the surce will be Mail-Enabled Cntacts in the target Mail-Enabled, AD Disabled The Active Directry User Accunt Cntrl prperty fr enabled r disabled will always be set t Disabled. In ther wrds, user accunts that are enabled in the surce, will be disabled in the target. 15

16 Cntact Fr Intra-Frest: Mail-Enabled Users in the surce will be Mail-Enabled Users in the target Mailbx-Enabled Users in the surce will becme Mail-Enabled Users in the target Mail-Enabled Cntacts in the surce will be Mail-Enabled Cntacts in the target This ptin IS NOT RECOMMENDED fr Active Directry Migratr prjects as user accunts will NOT be created in the target Cntacts, Mailbx-Enabled Users, Mail-Enabled Users will be created as Mail Enabled Cntacts in the target This ptin des nt have lgn capabilities, but can be used fr maintaining mail flw fr existing users, cntacts and distributin lists Micrsft Exchange cannt have duplicate bjects in the same rganizatin. As a result, all mail-enabled bjects will have Micrsft Exchange prperties remved, effectively creating nn-mail enabled bjects regardless f the surce bject type. As Is (default) Mail-Enabled Users in the surce will be nn-mail enabled users in the target Mailbx-Enabled Users in the surce will becme nn-mail enabled users in the target The Active Directry User Accunt Cntrl prperty fr enabled r disabled will be cpied as is. In ther wrds, user accunts that are enabled in the surce, will be enabled in the target Mail-Enabled Cntacts in the surce will be Nn-Mail Enabled Cntacts in the target Mail-Disabled, AD Enabled The Active Directry User Accunt Cntrl prperty fr enabled r disabled will always be set t Enabled. In ther wrds, user accunts that are disabled in the surce, will be enabled in the target Mail-Enabled Users in the surce will be Nn-Mail Enabled Users in the target Mailbx-Enabled Users in the surce will becme Nn-Mail Enabled Users in the target Mail-Enabled Cntacts in the surce will be Nn-Mail Enabled Cntacts in the target Mail-Disabled, AD Disabled The Active Directry User Accunt Cntrl prperty fr enabled r disabled will always be set t Disabled. In ther wrds, user accunts that are enabled in the surce, will be disabled in the target. Mail-Enabled Users in the surce will be Nn-Mail Enabled User in the target Mailbx-Enabled Users in the surce will becme Nn-Mail Enabled Users in the target Mail Enabled Cntacts in the surce will be Nn-Mail Enabled Cntacts in the target 16

17 Cntact This ptin IS NOT RECOMMENDED fr Active Directry Migratr prjects as user accunts will NOT be created in the target. Cntacts, Mailbx-Enabled Users, Mail-Enabled Users will be created as Nn-Mail Enabled Cntacts in the target. This ptin des nt have lgn capabilities, but can be used fr maintaining mail flw fr existing users, cntacts and distributin lists. The Mail-Enabled, AD Enabled ptin creates Active Directry users with lgn capabilities in the target dmain and all prperties frm the surce s bject, including mail addresses. The Mail-Enabled, AD Enabled ptin can verride the prperties fund in the Surce AD envirnment. Fr example, a Disabled Mail-Enabled User fund in the surce will be enabled in the target if the Mail- Enabled, AD Enabled ptin is selected. Cnversely, an enabled user fund in the surce will be disabled in the target if the Mail-Enabled, AD Disabled ptin is selected. Directry Sync will nt create Mailbx-Enabled Users in the target directry. Due t a samaccuntname size limit f 20 characters in Active Directry, user bjects with calculated samaccuntname names greater than 20 characters in length are truncated t 20 characters. Truncated samaccuntnames will be appended with a randm number frm 1 t 9999 t ensure uniqueness. This des nt apply t grup bjects. 36. Select an ptin frm the Create Nn-Mail Enabled Users as drp-dwn list: As Is (default) The Active Directry User Accunt Cntrl prperty fr enabled r disabled will be cpied as is. Enabled The Active Directry User Accunt Cntrl prperty fr enabled r disabled will always be set t Enabled fr Nn-Mailed Enabled Cntacts and Users. Nn-Mailed Enabled cntacts are always cpied as is. Disabled The Active Directry User Accunt Cntrl prperty fr enabled r disabled will always be set t Disabled fr Nn-Mailed Enabled Users. Nn-Mailed Enabled cntacts are always cpied as is. 37. Select an ptin fr handling user accunt cllisins when tw users f the same name are fund frm the Users Cllisins drp-dwn list: Update (default) If a user with the same name is fund in the target dmain, the users will be updated in the target AD. User cllisins are determined based n the ptins selected n the Matching tab f the prfile. Skip The user will nt be synchrnized int the target AD and a warning entry will be entered int the lg entry stating that the surce user will nt be synchrnized t the target directry. A user that was previusly synchrnized t the target will fail t sync if a manual /repushpull /resync is run. This ccurs because a target bject with a matching samaccuntname will already exist. If this is nt the desired behavir, befre running the /repushpull and /resync cmmands, administratrs shuld clear the target directry f previusly created bjects. 17

18 Rename - This allws yu t define a prefix r suffix t be added t the samaccuntname f the user when it is written in the target directry. This ptin creates a new user using the existing name and the prefix r suffix t bypass the user cllisin when selected. Prefix is selected by default. T define a specific value fr the prefix r suffix, select the Specific Value ptin and enter the value. T use a value frm an internal field, select the Internal Field ptin and select a field frm the drp-dwn list. If selecting an internal field, a Blean (True/False) field r an empty field shuld nt be selected. User accunts where the samaccuntname exceeds 20 characters will nt be created in the Target and an errr will be lgged. 37. Select an ptin frm the D nt verwrite target Prxy Addresses drp-dwn list: Yes Prxy Addresses will nly be updated during initial sync if the target bject has n prxy addresses. Prxy addresses will nt be updated n subsequent syncs. N (default) Prxy Addresses n the target are verwritten. 38. Select an ptin frm the Sync Objects drp-dwn list: One-Time bjects are synced nce after being marked as "Ready t Sync" in the SMART AD Migratr cnsle. Additinal syncs are nt perfrmed if there are changes in the surce. Grups are nt cntinuusly synced. Hwever, grup membership is cntinuusly updated. Cntinuus (default) bjects are cntinually synced between the surce and target after being marked as "Ready t Sync" in the SMART AD Migratr cnsle. 39. Select an ptin frm the Synchrnize SID Histry drp-dwn list: Yes SID histry is synchrnized. This ptin is nt available fr Intra-Frest prfiles. Review the Requirements fr mre infrmatin n Synchrnizing SID Histry Prerequisites. N (default) SID histry is nt migrated. Synchrnizing SID Histry is recmmended. Windws has built in prcesses that use SID Histry t update internal OS functins including Windws 8.x Mdern Apps, Netwrk Printers, and Micrsft Outlk. 40. Click the Grups sub-tab. 18

19 41. Select an ptin frm the Create Dmain Lcal Grups as drp-dwn list: Dmain Lcal (default) Dmain Lcal Grups in the surce will be Dmain Lcal Grups in the target. Universal Dmain Lcal Grups in the surce will be Universal Grups in the target. D Nt Create Dmain Lcal Grups in the surce will nt be created in the target. 42. Select an ptin frm the Create Glbal Grups as drp-dwn list: Glbal (default) Glbal Grups in the surce will be Glbal Grups in the target. Universal Glbal Grups in the surce will be Universal Grups in the target. D Nt Create Glbal Grups in the surce will nt be created in the target. 43. Select an ptin frm the Create Universal Grups as drp-dwn list: Universal (default) Universal Grups in the surce will be Universal Grups in the target. Dmain Lcal Universal Grups in the surce will be Dmain Lcal Grups in the target. D Nt Create Universal Grups in the surce will nt be created in the target. 44. Select an ptin fr handling grup cllisins when tw grups f the same name are fund frm the Grup Cllisins drp-dwn list: Merge If a grup with the same name is fund in the target dmain, the members f the surce grup will be added t the target grup. Grup cllisins are determined based n Name first, then based n the ptins selected n the Matching tab f the prfile. Skip The grup will nt be synchrnized int the target AD and a warning entry will be entered int the lg entry stating that the surce grup will nt be synchrnized t the target grup. 19

20 A grup that was previusly synchrnized t the target will fail t sync if a manual /repushpull /resync is run. This ccurs because a target bject with a matching samaccuntname will already exist. If this is nt the desired behavir, befre running the /repushpull and /resync cmmands, administratrs shuld clear the target directry f previusly created bjects. Rename - This allws yu t define a prefix r suffix t be added t the name f the grup when it is written in the target directry. This ptin creates a new grup using the existing name and the prefix r suffix t bypass the grup cllisin when selected. Prefix is selected by default. T define a specific value fr the prefix r suffix, select the Specific Value ptin and enter the value. T use a value frm an internal field, select the Internal Field ptin and select a field frm the drp-dwn list. If selecting an internal field, a Blean (True/False) field r an empty field shuld nt be selected. N ptin is selected by default fr the Grup Cllisins field and an errr message will appear if attempting t save the prfile withut selecting an ptin. Directry Sync will attempt t add a grup member t the target if it can find the member in the surce. If the member in the surce is in a different Dmain than the grup, the member will nly be added t the grup in the target if it already exists in the target. If Directry Sync cannt find the member in the surce, the member will nt be added t the grup in the target. The Sync Reprt will explain why a member culd r culd nt be synchrnized. 45. Click the Devices sub-tab. 20

21 A separate Synchrnizatin Prfile must be used when synchrnizing device bjects, and the Autmatically Mark Objects as Ready t Sync ptin n the AD Surce tab shuld be left as the default N, s the device bjects are nt inadvertently created in the target. 46. Select an ptin frm the Create Devices as drp-dwn list: As Is - (default) Enabled devices in the surce will be enabled devices in the target. Disabled devices in the surce will be disabled devices in the target. Enabled - Enabled and disabled devices in the surce will be enabled devices in the target. Disabled - Enabled and disabled devices in the surce will be disabled devices in the target. 47. Select an ptin fr handling user accunt cllisins when tw devices f the same name are fund frm the Device Cllisins drp-dwn list: Update (default) If a device with the same name is fund in the target AD, the device will be updated in the target AD. Skip If a device with the same name is fund in the target AD, the device will nt be added t the target AD. Rename This allws yu t define a prefix r suffix t be added t the name f the device when it is written in the target directry. This ptin creates a new device using the existing name and the prefix r suffix t bypass the device cllisin when selected. Prefix is selected by default. T define a specific value fr the prefix r suffix, select the Specific Value ptin and enter the value. T use a value frm an internal field, select the Internal Field ptin and select a field frm the drp-dwn list. If selecting an internal field, a Blean (True/False) field r an empty field shuld nt be selected. Devices where the samaccuntname exceeds 20 characters will nt be created in the Target and an errr will be lgged. Child bjects f an AD cmputer bject will be migrated, specifically cnnectinpint Object class items, during synchrnizatin with the target. This is a ne-time migratin f these item bjects. 48. Click the Exchange Target Optins tab. 21

22 49. Select an ptin frm the GAL Visibility drp-dwn list: Visible (default) Users and grups are visible in the GAL. Hidden Users and grups are hidden in the GAL. As Is Users and grups that are hidden in the GAL in the surce are hidden in the GAL in the target. Users and grups that are visible in the GAL in the surce are visible in the GAL in the target. When synchrnizing bjects int Exchange 2003 (nly), the ptin t hide frm the GAL will nt functin if the Recipient Update Service (RUS) is enabled. If synchrnizing t an Active Directry that des nt have Exchange in the envirnment, select the Hidden ptin t avid Active Directry cnstraint errrs. This ptin des nt apply t Intra-Frest prfiles. 22

23 50. If yu select Yes fr the Only Update Mailbx Enabled Objects ptin, nly mailbx-enabled bjects in the target directry will be updated with values frm the surce bject based n the mapping table settings. If this is set t N (default), mailbx-enabled bjects in the target directry will be skipped and nted in the sync reprt. If yu intend t update bth, yu must use tw separate prfiles. CAUTION: This is nt a cmmnly ccurring preference as the authritative bject is mst ften where the mailbx is lcated. 51. The Add x500 Prxy t Surce ptin allws yu t add the LegacyExchangeDN f mail enabled bject in the target as an additinal X500 prxy address t the surce mailbxes. If Yes is selected, an x500 prxy address is added t all crrespnding bjects in the AD Surce frest. If selecting Yes, yu must check the statement f understanding that appears belw the ptin. N is selected by default. This ptin must be set t N fr Intra-Frest prfiles. 52. The Resurce Frest ptin allws yu t define the AD Target as a Resurce Frest. This is required if yu plan t later migrate mailbxes t yur Target frest. If Yes is selected, the Master Accunt SID will be set n the AD Target bjects. N is selected by default. This ptin must be set t N fr Intra-Frest prfiles. 53. The Allw Enable/Disable f Mailbx Enabled Surce Objects ptin allws yu t define if enabling r disabling Mailbx Enabled Surce bjects is allwed. If Yes is selected, the enabling r disabling f Mailbx Enabled Surce bjects is allwed. N is selected by default. This ptin shuld be set t Yes if the ability t change the User Accunt Cntrl (UAC) n the Surce accunt is desired. If this is nt changed, the Disable/Enable Surce Actins in SMART AD Migratr will nt wrk (fr the Surce accunt). 54. Select Address Plicy ptins fr Users, Cntacts, and Grups: Unselected (default) Directry Sync will nt enable the target bject attribute t Autmatically update addresses based n address plicy in Exchange. Selected Directry Sync will enable the target bject attribute t Autmatically update addresses based n address plicy in Exchange. Directry Sync will nly apply the attribute t Autmatically update addresses based n address plicy t the target bject. It cannt apply the address plicy. This ptin des nt apply t Intra-Frest prfiles. 55. If selected the Address Plicy ptin fr User, Cntacts, r Grups, a drp-dwn list appears with the fllwing ptins: Enable plicy fr bjects created by DirSync Enable plicy fr bjects updated by DirSync Enable plicy fr bjects created r updated by DirSync Disable plicy fr bjects created by DirSync 23

24 Disable plicy fr bjects updated by DirSync Disable plicy fr bjects created r updated by DirSync 56. Click the Target DCs tab t define the list f target Dmain Cntrllers (DC s) t use when Directry Sync is searching fr matched bjects. 57. Click Add DC(s) t pen the Active Directry DC Selectin windw. Click Refresh DCs t find all available Dmain Cntrllers. Available ptins include Ping Servers t test the availability f the selected Dmain Cntrllers and Test Cnnectins t test the cnnectin t the LDAP server. Select ne r mre Dmain Cntrller (use Ctrl+Click t select mre than ne) and click OK t add the Dmain Cntrllers t the list f Target DCs. 24

25 If yu selected Dmain level matching in the Target tab, nly select Dmain Cntrllers fr the target Dmain. N ther Dmains will be searched. If yu have selected Frest level matching in the Target tab, yu must add at least ne Dmain Cntrller fr each Dmain that shuld be searched fr matched bjects. If yu d nt select at least ne Dmain Cntrller fr a Dmain, that Dmain will nt be searched during synchrnizatin. Select mre than ne Dmain Cntrller in a Dmain fr failver purpses. Additinally defined Dmain Cntrllers are nly searched fr matches if the previus Dmain Cntrller is unavailable. 58. The Active Directry DC Selectin windw clses and the selected Dmain Cntrllers appear in the Target DC s list. The rder the dmain cntrllers are used can be selected by entering a number value in the Pririty clumn (lwest number = first). Available ptins include Ping Servers t test the availability f the selected Dmain Cntrllers and Test Cnnectins t test the cnnectin t the LDAP server. Dmain Cntrllers with n pririty set will be used after thse with a pririty. If n pririty is set fr the servers in a Dmain, they will be used in the rder listed in the table. A Dmain Cntrller that is the Glbal Catalg Server selected n the AD Target tab is given tp pririty regardless f the value in the Pririty field. N tw DC s in a Dmain can have the same pririty. 59. Click the Matching tab. 25

26 AD attributes used fr matching shuld be indexed. Fllw the prcedure at t index AD attributes. 60. Select an ptin frm the Matching Level drp-dwn list: Frest (default) Matching is dne against the target Frest Dmain Matching is dne against the target Dmain This ptin is set t Dmain fr Intra-Frest prfiles. 61. Select an ptin frm the Matching Actin drp-dwn list: Create r Update (default) Creates bjects that d nt have matching bjects in the Target and updates bjects that have matching bjects in the Target. Create nly Creates bjects that d nt have matching bjects in the Target. Objects that have matching bjects in the Target are NOT updated, unless the bject was created by Directry Sync. This means that even during an initial sync r a sync after a reset, bjects previusly created by Directry Sync will be updated. Update nly Updates bjects that have matching bjects in the Target. Objects that d nt have matching bjects in the Target are NOT created. Match nly, N Update Matching bjects are updated in SQL, but n updates are dne in the Target and n new bjects are created in the Target. 62. Select the Match bject types ptin t enable bject type matching. Object types are Users, Cntacts, Grups, and Devices. This ptin is enabled (checked) by default. 63. The default surce t target attribute matching pairs are displayed. This defines what attributes Directry Sync will use t match bjects in the Surce t bjects in the Target, as well as the rder in which they will be used. The belw table displays the default matching attribute pairs: Surce Target samaccuntname mail cn samaccuntname mail cn T custmize the matching, select attributes frm the drp-dwn lists under Surce and/r Target r type in the names f attributes in the fields. The matching pairs are either/r statements (nt and statements) with the first match attempted n the tp rw pair (Default: samaccuntname -> samaccuntname) and then prceeding in descending rder t the next rw pair and s n. At least ne matching pair is required fr the prfile t be saved. 26

27 64. Select an ptin frm the Re-Link drp-dwn list: Enabled (default) SMART Directry Sync will attempt t re-link bjects in the target by first lking fr an bject that has the admindisplayname stamped with the surce bject's unique identifier. If an bject is fund, then thse tw bjects are linked and n ther attempts at matching are perfrmed. If an bject is nt fund, then the prcess attempts t match t an bject by searching based n the matching criteria. If a matching bject is nt fund, then a new bject is created. Disabled SMART Directry Sync will nt attempt t re-link bjects in the target and will always match based n the matching criteria. Whenever SMART Directry Sync creates a new bject in the target r matches t an existing bject in the target, it stamps the admindisplayname attribute (fr Active Directry) r the $BTSurceDirectryID prperty (fr Dmin) f the target bject with the surce bject's unique identifier (bjectguid fr AD bjects and UNID fr Dmin bjects). This effectively links these tw bjects tgether. This link is als maintained between the tw bjects in the SQL database and future updates are based n this SQL link. Hwever, when a prfile is reset, these SQL recrds are deleted. When Re-Link is enabled, perfrmance can be imprved by indexing the admindisplayname attribute. Fllw the prcedure at t index AD attributes. 65. If the Re-Link ptin is enabled, select an ptin frm the Restre Ready t Sync drp-dwn list: Yes (default) The re-link prcess will set all re-linked bjects t Ready T Sync. N The re-link prcess will nt reset the Ready T Sync setting n re-linked bjects. This wuld allw yu t prevent changes t bjects until they are prepared. 66. Click the Mapping tab t view the default mapping r t edit hw attributes shuld be translated frm the surce t the target Active Directry. Review the table and make the apprpriate changes fr yur envirnment. Duble-click a cell in the mapping table select a different field r type frm a drp-dwn list. Click abve the first rw t create a new entry. Duble-click n a cell in the Cmments clumn t enter a cmment. Appendix D cntains the default mapping. T revert t the default mappings, use CTRL+A t select all mappings, delete the mappings (Delete key), and click Yes when prmpted t remve all entries. The default mapping fr attributes will be applied unless deleted. When creating custm mapping fr an attribute, the default mapping fr the attribute shuld be deleted. There are tw Target Type clumns in the table. This allws yu t restrict the type f bject in the target directry that can be updated. If yu set bth types t the same value, then this mapping will nly apply t that bject type. If yu set ne t persn and the ther t grup, the mapping will apply t user and grup bjects nly. If bth are set t, the mapping is unrestricted and will apply t all bject types. The msexch mappings are nt valid fr Intra-Frest prfiles. 27

28 Values that can be used fr either mapping r matching can be entered manually r imprted frm a CSV file in the Mapped Values dialg bx. Mapped values fr device bjects is nt currently supprted. This feature will be supprted in a future release. 1. Click the Mapped Values buttn. The Mapped Values windw appears. 2. Values can be entered manually by clicking n the first rw. 3. Values can als be imprted frm a CSV file by clicking the Imprt buttn. 28

29 4. Select a CSV file that has Surce fields and values, Target fields and values, and the applicatin f the mapping r matching. The final value f each rw can be Match, Map, r MatchMap. MatchMap applies bth matching and mapping. 67. Click Save t verify all required fields are ppulated and save the prfile. Yu can save an incmplete prfile as lng as it is suspended. 68. Click Overrides t pen the table f mapping verrides. These represent default system mappings specifically fr the internal SQL fields, and are used t transpse values during creatin and synchrnizatin. Overrides are custmizable and apply t all prfiles. See Appendix E fr mre infrmatin n editing Overrides. Overrides fr device bjects is nt currently supprted. This feature will be supprted in a future release. 69. Create additinal synchrnizatin prfiles as needed. T cpy an existing prfile, right-click n a prfile in the table and select Cpy. All prfile settings will be cpied int a new prfile that can then be edited as necessary. New prfiles created by cpy are suspended by default. Select the prfile in the table and click Activate Prfile. 29

30 2.3 Adding an Exchange Migratin Synchrnizatin Prfile The SMART Directry Sync Exchange Migratin synchrnizatin prfile is used in supprt f an Exchange migratin utilizing Binary Tree s E2E Cmplete prduct. T add an Exchange Migratin synchrnizatin prfile: 1. On the Prfiles tab, click Add Prfile. 2. In the Prfile Type Selectin windw, select Exchange Migratin and then click OK. The fllwing Prfile Types are als available: AD Migratin/Synchrnizatin used fr bth AD t AD directry synchrnizatin and in supprt f an Active Directry migratin utilizing Binary Tree s SMART Active Directry Migratr prduct. Active Directry t Dmin Directry used t synchrnize bjects frm an Active Directry surce t a Dmin directry target. Dmin Directry t Active Directry used t synchrnize bjects frm a Dmin directry surce t an Active Directry target. Windw Server Migratin used in supprt f a Windws Server migratin utilizing Binary Tree s Windws Server Migratin prduct. 30

31 3. A new pane appears at the bttm f the cnsle which prvides the ability t cnfigure ptins fr synchrnizatin. 4. On the General tab, enter a name t identify the prfile in the Name field. 5. Select the scpe f the prfile frm the Scpe drp-dwn list: Inter-Frest (default) will synchrnize dmains in different frests. Intra-Frest will synchrnize dmains within a frest. If selected, the Add x500 Prxy t Surce and Resurce Frest ptins must be set t N and msexch mappings are invalid. Befre the prfile can be saved with Intra-Frest chsen as the scpe, the mappings fr all f the msexch attributes will need t be remved. 6. Select the status f the prfile frm the Status drp-dwn list: Active will synchrnize manually r as scheduled as sn as the prfile is saved Suspended Nt active, will nt synchrnize 7. Select the lgging level f the prfile frm the Lgging drp-dwn list: Lw nly errrs are lgged Medium errrs and warnings are lgged High all messages (errrs, warnings, infrmatin, etc.) are lgged (shuld be used fr trubleshting purpses nly) 8. Select an Audit Lgging ptin frm the drp-dwn list: Enabled Recrds bject and attribute changes in the Audit Lg Disabled Object and attribute changes will nt be recrded in the Audit Lg 31

32 9. Fr Schedule, select the schedule: By frequency enter the apprpriate frequency r the specific time fr the synchrnizatin prcess t run fr yur envirnment. Zer (0) is nt a valid value fr frequency. The minimum interval is 15 minutes. At specific times(s) enter ne r mre specific times r select times frm the drp-dwn list f times. A selected time can be deleted by selecting the time and clicking the Delete key. Manual nly the synchrnizatin prcess will nt run until it is manually started. If yu chse the By frequency ptin, SMART Directry Sync will initiate a synchrnizatin when an active prfile is saved. Select the At specific time(s) ptin and select a time in the future r select the Manual nly ptin if yu want t save an active prfile withut it syncing right away. This wuld be helpful if yu wanted t run a Sync Reprt r inspect items in SQL befre pulling them int the target Active Directry. 10. Click the AD Surce tab enter credentials that have read access t the surce Active Directry. The required read access must extend t the Deleted Accunts cntainer, which can require a privileged accunt. 11. In the User Name field, enter the Active Directry User Name. The credential shuld be entered as a user principal name (fr example, jsmith@acmecrp.cm) 12. In the Passwrd field, enter the passwrd assigned t the Active Directry user. 13. In the Glbal Catalg Server field, enter the IP Address r fully qualified dmain name f the server (FQDN) fr the Glbal Catalg Server r a Dmain Cntrller that will be used fr all read peratins. 32

33 The entered credentials and Glbal Catalg Server/Dmain Cntrller must have access t all Dmains and subdmains that are required t synchrnize. 14. Select an Attribute Change Detectin ptin frm the drp-dwn list: Enabled Only attributes changed n the surce bject will be synchrnized Disabled All attributes n the surce bject will be synchrnized 15. Click Add OU(s) t display a list f OU(s) (rganizatinal units) available t synchrnize. 16. Select the apprpriate surce OU s and click OK. The selected surce OUs are displayed in the Surce OUs table. The synchrnize Sub OUs and ther checkbxes nly display when yu select an OU and then click the Add OU(s) buttn. T deselect an OU frm the surce, select it and then press the Remve OU buttn r clicking the Delete key. 17. The fllwing Surce OU fields display at the bttm f the screen used in the abve example. Surce OU Reflects the OU selected frm the tree view. Sub OUs Select this ptin t synchrnize Sub-OUs. The checkbx is selected by default. Clear this ptin if yu d nt want t synchrnize sub-ous. Grups checkbx is selected by default. Clear this ptin t skip grups frm being synchrnized. Disabled Users Select this ptin t synchrnize Disabled Users. The checkbx is selected by default. Clear this ptin t prevent Disabled Users frm being synchrnized. Nn-Mail Enabled Select this ptin t synchrnize Nn-mail enabled bjects. The checkbx is nt selected by default. Clear this ptin t skip Nn-mail enabled bjects frm being synchrnized. 33

34 User Filter This is a LDAP filter and can be used t filter synchrnizatin t specific bject types r thse bjects exhibiting specific attribute prperties. See Using the User and Grup LDAP Filters fr mre infrmatin. Grup Filter This is a LDAP filter and can be used t filter grups based n the entered criteria. See Using the User and Grup LDAP Filters fr mre infrmatin. The default User Filter and Grup Filter values can be custmized fr yur envirnment by editing the cnfiguratin file and changing the DefaultUserOUFilter and DefaultGrupOUFilter values. Binary Tree recmmends that yu test the LDAP filter syntax prir t saving yur changes. 18. Click the Surce DCs tab t define the list f Surce Dmain Cntrllers (DCs) used fr synchrnizatin. 34

35 19. Click Add DC(s) t pen the Active Directry DC Selectin windw. Click Refresh DCs t find all available Dmain Cntrllers. Available ptins include Ping Servers t test the availability f the selected Dmain Cntrllers and Test Cnnectins t test the cnnectin t the LDAP server. Select ne r mre Dmain Cntrllers and click OK t add the Dmain Cntrllers t the list f Surce DCs. If yur Active Directry frest cntains mre than ne dmain it may be necessary t add at least ne dmain cntrller frm each dmain. When SMART Directry Sync attempts t reslve bjects, such as grup members r a user's manager, that are in anther Dmain (than the ne specified n the Surce tab), it will reference the dmain cntrllers list t find a valid DC t use. T ensure that grup membership and manager/subrdinate relatinships are prperly recreated, it is recmmended t add the apprpriate DC s fr alternate dmains t the Surce DC s tab. 20. The Active Directry DC Selectin windw clses and the selected Dmain Cntrllers appear in the Surce DC s list. The rder the dmain cntrllers are used fr each Dmain can be selected by entering a number value in the Pririty clumn (lwest number = first). If the highest pririty DC is unavailable, Directry Sync will use the next DC. Available ptins include Ping Servers t test the availability f the selected Dmain Cntrllers and Test Cnnectins t test the cnnectin t the LDAP server. Dmain Cntrllers with n pririty set will be used after thse with a pririty. If n pririty is set fr the servers in a Dmain, they will be used in the rder listed in the table. A Dmain Cntrller that is the Glbal Catalg Server selected n the AD Surce tab is given tp pririty regardless f the value in the Pririty field. N tw DC s in a Dmain can have the same pririty. 35

36 21. Click the AD Target tab. 22. In the User Name field, enter the name f the Active Directry user that has the required rights t the Target directry. The credential shuld be entered as a user principal name (fr example, jsmith@acmecrp.cm) 23. In the Passwrd field, enter the passwrd f the Active Directry user. These credentials shuld have write access t target OU, as well as Dmains r subdmains that may cntain matched users. 24. In the Glbal Catalg Server field, enter the IP Address r fully qualified dmain name f the server (FQDN) f the Glbal Catalg Server r Dmain Cntrller that will be used fr all write peratins. 25. In the Target OU, Click Brwse t select a target OU. Any newly created bjects will be written t this OU. 26. Check the D nt create surce OUs in target ptin if yu d nt want the surce OU structure t be created as bjects are synchrnized t the target. All bjects will be created directly in the Target OU specified fr that prfile. 27. Enter a default passwrd fr new users in the Default Passwrd field. Directry Sync des nt validate the passwrd plicies present within yur dmains. Verify that the passwrd entered cmplies with the passwrd plicy f yur target envirnment. Objects will fail t be created if the passwrd vilates the target directry's passwrd plicy. The default passwrd cannt exceed 128 characters in length. 36

37 28. Select an ptin frm the Preserve Objects in Target drp-dwn list t cntrl what happens t target bjects when the crrespnding surce bjects are deleted: N (default) When bjects are deleted in the surce, the crrespnding bjects will be deleted frm the target. This nly applies t bjects created in the target by SMART Directry Sync. Yes Objects that are deleted in the surce will nt be deleted in the target. 29. Select an ptin frm the Preserve Deleted Objects in Target As Is drp-dwn list t cntrl what happens t target bjects if they are deleted: N (default) If an bject previusly synchrnized is deleted n the target, it will be recreated. Yes If an bject previusly synchrnized is deleted n the target, it will nt be recreated. 30. Click the AD Target Optins tab. 31. Click the Users sub-tab. 32. Select an ptin frm the Create Users as drp-dwn list: Fr Inter-Frest: As Is (default) Mail-Enabled Users in the surce will be Mail-Enabled Users in the target Mailbx-Enabled Users in the surce will becme Mail-Enabled Users in the target The Active Directry User Accunt Cntrl prperty fr enabled r disabled will be cpied as is. In ther wrds, user accunts that are enabled in the surce, will be enabled in the target. Mail-Enabled Cntacts in the surce will be Mail-Enabled Cntacts in the target 37

38 Mail-Enabled, AD Enabled The Active Directry User Accunt Cntrl prperty fr enabled r disabled will always be set t Enabled. In ther wrds, user accunts that are disabled in the surce, will be enabled in the target Mail-Enabled Users in the surce will be Mail-Enabled Users in the target Mailbx-Enabled Users in the surce will becme Mail-Enabled Users in the target Mail-Enabled Cntacts in the surce will be Mail-Enabled Cntacts in the target Mail-Enabled, AD Disabled Cntact Fr Intra-Frest: The Active Directry User Accunt Cntrl prperty fr enabled r disabled will always be set t Disabled. In ther wrds, user accunts that are enabled in the surce, will be disabled in the target. Mail-Enabled Users in the surce will be Mail-Enabled Users in the target Mailbx-Enabled Users in the surce will becme Mail-Enabled Users in the target Mail-Enabled Cntacts in the surce will be Mail-Enabled Cntacts in the target Cntacts, Mailbx-Enabled Users, Mail-Enabled Users will be created as Mail Enabled Cntacts in the target This ptin des nt have lgn capabilities, but can be used fr maintaining mail flw fr existing users, cntacts and distributin lists Micrsft Exchange cannt have duplicate bjects in the same rganizatin. As a result, all mail-enabled bjects will have Micrsft Exchange prperties remved, effectively creating nn-mail enabled bjects regardless f the surce bject type. As Is (default) Mail-Enabled Users in the surce will be nn-mail enabled users in the target Mailbx-Enabled Users in the surce will becme nn-mail enabled users in the target The Active Directry User Accunt Cntrl prperty fr enabled r disabled will be cpied as is. In ther wrds, user accunts that are enabled in the surce, will be enabled in the target Mail-Enabled Cntacts in the surce will be Nn-Mail Enabled Cntacts in the target Mail-Disabled, AD Enabled The Active Directry User Accunt Cntrl prperty fr enabled r disabled will always be set t Enabled. In ther wrds, user accunts that are disabled in the surce, will be enabled in the target Mail-Enabled Users in the surce will be Nn-Mail Enabled Users in the target Mailbx-Enabled Users in the surce will becme Nn-Mail Enabled Users in the target Mail-Enabled Cntacts in the surce will be Nn-Mail Enabled Cntacts in the target 38

39 Mail-Disabled, AD Disabled Cntact The Active Directry User Accunt Cntrl prperty fr enabled r disabled will always be set t Disabled. In ther wrds, user accunts that are enabled in the surce, will be disabled in the target. Mail-Enabled Users in the surce will be Nn-Mail Enabled User in the target Mailbx-Enabled Users in the surce will becme Nn-Mail Enabled Users in the target Mail-Enabled Cntacts in the surce will be Nn-Mail-Enabled Cntacts in the target Cntacts, Mailbx-Enabled Users, Mail-Enabled Users will be created as Nn-Mail Enabled Cntacts in the target. This ptin des nt have lgn capabilities, but can be used fr maintaining mail flw fr existing users, cntacts and distributin lists. The Mail-Enabled, AD Enabled ptin creates Active Directry users with lgn capabilities in the target dmain and all prperties frm the surce s bject, including mail addresses. The Mail-Enabled, AD Enabled ptin can verride the prperties fund in the Surce AD envirnment. Fr example, a Disabled Mail-Enabled User fund in the surce will be enabled in the target if the Mail- Enabled, AD Enabled ptin is selected. Cnversely, an enabled user fund in the surce will be disabled in the target if the Mail-Enabled, AD Disabled ptin is selected. Directry Sync will nt create Mailbx-Enabled Users in the target directry. Due t a samaccuntname size limit f 20 characters in Active Directry, user bjects with calculated samaccuntname names greater than 20 characters in length are truncated t 20 characters. Truncated samaccuntnames will be appended with a randm number frm 1 t 9999 t ensure uniqueness. This des nt apply t grup bjects. 33. Select an ptin fr handling user accunt cllisins when tw users f the same name are fund frm the Users Cllisins drp-dwn list: Update (default) If a user with the same name is fund in the target dmain, the users will be updated in the target AD. User cllisins are determined based n the ptins selected n the Matching tab f the prfile. Skip The user will nt be synchrnized int the target AD and a warning entry will be entered int the lg entry stating that the surce user will nt be synchrnized t the target directry. A user that was previusly synchrnized t the target will fail t sync if a manual /repushpull /resync is run. This ccurs because a target bject with a matching samaccuntname will already exist. If this is nt the desired behavir, befre running the /repushpull and /resync cmmands, administratrs shuld clear the target directry f previusly created bjects. 39

40 Rename - This allws yu t define a prefix r suffix t be added t the samaccuntname f the user when it is written in the target directry. This ptin creates a new user using the existing name and the prefix r suffix t bypass the user cllisin when selected. Prefix is selected by default. T define a specific value fr the prefix r suffix, select the Specific Value ptin and enter the value. T use a value frm an internal field, select the Internal Field ptin and select a field frm the drp-dwn list. If selecting an internal field, a Blean (True/False) field r an empty field shuld nt be selected. User accunts where the samaccuntname exceeds 20 characters will nt be created in the Target and an errr will be lgged. 34. Select an ptin frm the D nt verwrite target Prxy Addresses drp-dwn list: Yes Prxy Addresses will nly be updated during initial sync if the target bject has n prxy addresses. Prxy addresses will nt be updated n subsequent syncs. N (default) Prxy Addresses n the target are verwritten. 35. Click the Grups sub-tab. 36. Select an ptin frm the Create Grups as drp-dwn list: As Is (default) Grups are created as they are in the surce: Glbal grups in the surce will be Glbal grups in the target Universal grups in the surce will be Universal grups in the target Cntact Grups will be cntacts in the target. Glbal Grup All grups in the surce will be Glbal grups in the target. Universal Grup All grups in the surce will be Universal grups in the target. 40

41 Universal grups must be used if the target grup will cntain members frm ther AD Dmains, therwise thse members will nt be added t the grup. 37. Select an ptin fr handling grup cllisins when tw grups f the same name are fund frm the Grup Cllisins drp-dwn list: Merge If a grup with the same name is fund in the target dmain, the members f the surce grup will be added t the target grup. Grup cllisins are determined based n Name first, then based n the ptins selected n the Matching tab f the prfile. Skip (default) The grup will nt be synchrnized int the target AD and a warning entry will be entered int the lg entry stating that the surce grup will nt be synchrnized t the target grup. A grup that was previusly synchrnized t the target will fail t sync if a manual /repushpull /resync is run. This ccurs because a target bject with a matching samaccuntname will already exist. If this is nt the desired behavir, befre running the /repushpull and /resync cmmands, administratrs shuld clear the target directry f previusly created bjects. Rename - This allws yu t define a prefix r suffix t be added t the name f the grup when it is written in the target directry. This ptin creates a new grup using the existing name and the prefix r suffix t bypass the grup cllisin when selected. Prefix is selected by default. T define a specific value fr the prefix r suffix, select the Specific Value ptin and enter the value. T use a value frm an internal field, select the Internal Field ptin and select a field frm the drp-dwn list. If selecting an internal field, a Blean (True/False) field r an empty field shuld nt be selected. Directry Sync will attempt t add a grup member t the target if it can find the member in the surce. If the member in the surce is in a different Dmain than the grup, the member will nly be added t the grup in the target if it already exists in the target. If Directry Sync cannt find the member in the surce, the member will nt be added t the grup in the target. The Sync Reprt will explain why a member culd r culd nt be synchrnized. 41

42 38. Click the Exchange Target Optins tab. 39. Select an ptin frm the GAL Visibility drp-dwn list: When synching bjects int Exchange 2003 (nly), the ptin t hide frm the GAL will nt functin if the Recipient Update Service (RUS) is enabled. If synching t an Active Directry that des nt have Exchange in the envirnment, select the Hidden ptin t avid Active Directry cnstraint errrs. This ptin des nt apply t Intra-Frest prfiles. Visible (default) Users and grups are visible in the GAL. Hidden Users and grups are hidden in the GAL. As Is Users and grups that are hidden in the GAL in the surce are hidden in the GAL in the target. Users and grups that are visible in the GAL in the surce are visible in the GAL in the target. 40. If yu select Yes fr the Only Update Mailbx Enabled Objects ptin, nly mailbx-enabled bjects in the target directry will be updated with values frm the surce bject based n the mapping table settings. If this is set t N (default), mailbx-enabled bjects in the target directry will be skipped and nted in the sync reprt. If yu intend t update bth, yu must use tw separate prfiles. USE WITH CAUTION! This is nt a cmmnly ccurring preference as the authritative bject is mst ften where the mailbx is lcated. 42

43 41. The Add x500 Prxy t Surce ptin allws yu t add the LegacyExchangeDN f mail enabled bject in the target as an additinal X500 prxy address t the surce mailbxes. If Yes is selected, an x500 prxy address is added t all crrespnding bjects in the AD Surce frest. If selecting Yes, yu must check the statement f understanding that appears belw the ptin. N is selected by default. This ptin must be set t N fr Intra-Frest prfiles. 42. The Resurce Frest ptin allws yu t define the AD Target as a Resurce Frest. This is required if yu plan t later migrate mailbxes t yur Target frest. If Yes is selected, the Master Accunt SID will be set n the AD Target bjects. N is selected by default. This ptin must be set t N fr Intra-Frest prfiles. 43. Select Address Plicy ptins fr Users, Cntacts, and Grups: Unselected (default) Directry Sync will nt enable the target bject attribute t Autmatically update addresses based n address plicy in Exchange. Selected Directry Sync will enable the target bject attribute t Autmatically update addresses based n address plicy in Exchange. Directry Sync will nly apply the attribute t Autmatically update addresses based n address plicy t the target bject. It cannt apply the address plicy. This ptin des nt apply t Intra-Frest prfiles. 44. If selected the Address Plicy ptin fr User, Cntacts, r Grups, a drp-dwn list appears with the fllwing ptins: Enable plicy fr bjects created by DirSync Enable plicy fr bjects updated by DirSync Enable plicy fr bjects created r updated by DirSync Disable plicy fr bjects created by DirSync Disable plicy fr bjects updated by DirSync Disable plicy fr bjects created r updated by DirSync 43

44 45. Click the Target DCs tab t define the list f target Dmain Cntrllers (DCs) t use when Directry Sync is searching fr matched bjects. 46. Click Add DC(s) t pen the Active Directry DC Selectin windw. Click Refresh DCs t find all available Dmain Cntrllers. Available ptins include Ping Servers t test the availability f the selected Dmain Cntrllers and Test Cnnectins t test the cnnectin t the LDAP server. Select ne r mre Dmain Cntrllers (use Ctrl+click t select mre than ne) and click OK t add the Dmain Cntrllers t the list f Target DCs. 44

45 If yu selected Dmain level matching in the Target tab, nly select Dmain Cntrllers fr the target Dmain. N ther Dmains will be searched. If yu have selected Frest level matching in the Target tab, yu must add at least ne Dmain Cntrller fr each Dmain that shuld be searched fr matched bjects. If yu d nt select at least ne Dmain Cntrller fr a Dmain, that Dmain will nt be searched during synchrnizatin. Select mre than ne Dmain Cntrller in a Dmain fr failver purpses. Additinally defined Dmain Cntrllers are nly searched fr matches if the previus Dmain Cntrller is unavailable. 47. The Active Directry DC Selectin windw clses and the selected Dmain Cntrllers appear in the Target DC s list. The rder the dmain cntrllers are used can be selected by entering a number value in the Pririty clumn (lwest number = first). Available ptins include Ping Servers t test the availability f the selected Dmain Cntrllers and Test Cnnectins t test the cnnectin t the LDAP server. Dmain Cntrllers with n pririty set will be used after thse with a pririty. If n pririty is set fr the servers in a Dmain, they will be used in the rder listed in the table. A Dmain Cntrller that is the Glbal Catalg Server selected n the AD Target tab is given tp pririty regardless f the value in the Pririty field. N tw DC s in a Dmain can have the same pririty. 48. Click the Matching tab. 45

46 AD attributes used fr matching shuld be indexed. Fllw the prcedure at t index AD attributes. 49. Select an ptin frm the Matching Level drp-dwn list: Frest (default) Matching is dne against the target Frest. Dmain Matching is dne against the target Dmain This ptin is set t Dmain fr Intra-Frest prfiles. 50. Select an ptin frm the Matching Actin drp-dwn list: Create r Update (default) Creates bjects that d nt have matching bjects in the Target and updates bjects that have matching bjects in the Target. Create nly Creates bjects that d nt have matching bjects in the Target. Objects that have matching bjects in the Target are NOT updated, unless the bject was created by Directry Sync. This means that even during an initial sync r a sync after a reset, bjects previusly created by Directry Sync will be updated. Update nly Updates bjects that have matching bjects in the Target. Objects that d nt have matching bjects in the Target are NOT created. During synchrnizatin, if a surce bject matches t mre than ne target bject, the surce bject is skipped and a warning is generated in the sync reprt. 51. Select the Match bject types ptin t enable bject type matching. Object types are Users, Cntacts, and Grups. This ptin is disabled (unchecked) by default. 52. The default surce t target attribute matching pairs are displayed. This defines what attributes Directry Sync will use t match bjects in the Surce t bjects in the Target, as well as the rder in which they will be used. The belw table displays the default matching attribute pairs: Surce Target samaccuntname mail cn samaccuntname mail cn T custmize the matching, select attributes frm the drp-dwn lists under Surce and/r Target r type in the names f attributes in the fields. The matching pairs are either/r statements (nt and statements) with the first match attempted n the tp rw pair (Default: samaccuntname -> samaccuntname) and then prceeding in descending rder t the next rw pair and s n. Hwever, mre than ne Surce attribute can be paired with a single Target attribute. At least ne matching pair is required fr the prfile t be saved. 53. Select an ptin frm the Re-Link drp-dwn list: Enabled (default) SMART Directry Sync will attempt t re-link bjects in the target by first lking fr an bject that has the admindisplayname stamped with the surce bject's unique identifier. If an bject is fund, then thse tw bjects are linked and n ther attempts at matching are perfrmed. If an 46

47 bject is nt fund, then the prcess attempts t match t an bject by searching based n the matching criteria. If a matching bject is nt fund, then a new bject is created. Disabled SMART Directry Sync will nt attempt t re-link bjects in the target and will always match based n the matching criteria. Whenever SMART Directry Sync creates a new bject in the target r matches t an existing bject in the target, it stamps the admindisplayname attribute (fr Active Directry) r the $BTSurceDirectryID prperty (fr Dmin) f the target bject with the surce bject's unique identifier (bjectguid fr AD bjects and UNID fr Dmin bjects). This effectively links these tw bjects tgether. This link is als maintained between the tw bjects in the SQL database and future updates are based n this SQL link. Hwever, when a prfile is reset, these SQL recrds are deleted. When Re-Link is enabled, perfrmance can be imprved by indexing the admindisplayname attribute. Fllw the prcedure at t index AD attributes. 54. Click the Mapping tab t view the default mapping r t edit hw attributes shuld be translated frm the surce t the target Active Directry. Review the table and make the apprpriate changes fr yur envirnment. Duble-click a cell in the mapping table select a different field r type frm a drp-dwn list. Click abve the first rw t create a new entry. Duble-click n a cell in the Cmments clumn t enter a cmment. See AD Surce AD Target Default Mapping fr the default mapping. T revert t the default mappings, use CTRL+A t select all mappings, delete the mappings (Delete key), and click Yes when prmpted t remve all entries. The default mapping fr attributes will be applied unless deleted. When creating custm mapping fr an attribute, the default mapping fr the attribute shuld be deleted. When creating a custm mapping, use a CustmXX field (Custm01 t Custm99) that has nt already been used fr ther mappings r in the verrides. D nt use a BTCustm0XX field. Either review this infrmatin in the SMART Directry Sync Mapping and Overrides user interface r in the SQL database. There are tw Target Type clumns in the table. This allws yu t restrict the type f bject in the target directry that can be updated. If yu set bth types t the same value, then this mapping will nly apply t that bject type. If yu set ne t persn and the ther t grup, the mapping will apply user and grup bjects nly. If bth are set t, the mapping is unrestricted and will apply t all bject types. The msexch mappings are nt valid fr Intra-Frest prfiles. 47

48 Values that can be used fr either mapping r matching can be entered manually r imprted frm a CSV file in the Mapped Values dialg bx. 1. Click the Mapped Values buttn. The Mapped Values windw appears. 2. Values can be entered manually by clicking n the first rw. 3. Values can als be imprted frm a CSV file by clicking the Imprt buttn. 4. Select a CSV file that has Surce fields and values, Target fields and values, and the applicatin f the mapping r matching. The final value f each rw can be Match, Map, r MatchMap. MatchMap applies bth matching and mapping. 48

49 55. Click Save t verify all required fields are ppulated and save the prfile. Incmplete prfiles can be suspended and cmpleted at a later time by clicking Suspend Prfile. Yu can save an incmplete prfile as lng as it is suspended. 56. Click Overrides t pen the table f mapping verrides. These represent default system mappings that apply t all prfiles. Yu may custmize Overrides. See Custmizing Overrides fr mre infrmatin n editing Overrides. 57. Create additinal synchrnizatin prfiles as needed. T cpy an existing prfile, right-click n a prfile in the table and select Cpy. All prfile settings will be cpied int a new prfile that can then be edited as necessary. New prfiles created by cpy are suspended by default. Select the prfile in the table and click Activate Prfile. 2.4 Imprting and Exprting a Prfile Synchrnizatin prfiles can be imprted and exprted. The Exprt Prfile ptin exprts all f the cnfiguratin ptins fr the selected prfile and creates a DSPrfile file that can be saved fr backup purpses. The Imprt Prfile ptin allws a DSPrfile file t be imprted and all f the cnfiguratin ptins fr a prfile restred. Imprted prfiles are suspended by default and must be activated befre they can be synchrnized. T imprt a synchrnizatin prfile: 1. Click Imprt Prfile. 2. Select an imprt file and click Open. The imprted prfile is suspended by default and must be activated befre it can be synchrnized. 49

50 T exprt a synchrnizatin prfile: 1. When viewing a prfile, click Exprt Prfile. Yu can als right-click n a prfile in the table and select Exprt. 2. Enter a file name fr the exprt file and click Save. 2.5 Suspending and Activating a Prfile Suspending a synchrnizatin prfile disables the prfile frm synchrnizing. Nte that yu als cannt manually run a synchrnizatin f a suspended prfile using the Sync Prfile buttn, right-click menu, r cmmand line cmmands. Suspended prfiles remain in the list f prfiles and can be reactivated at time. T suspend an active synchrnizatin prfile: 1. Select a prfile yu wish t suspend. 2. Click Suspend Prfile. The status f the prfile is changed t Suspended. T activate a suspended synchrnizatin prfile: 1. Select a suspended prfile yu wish t activate. 2. Click Activate Prfile. The status f the prfile is changed t Active. 2.6 Remving a Prfile Remving a synchrnizatin prfile will delete it frm the list f prfiles. Remved prfiles cannt be restred. T remve a synchrnizatin prfile: 1. Select a prfile yu wish t remve. 2. Click Remve Prfile. 3. Click Yes t cnfirm. The prfile is deleted frm the list f prfiles. 2.7 Resetting a Prfile Resetting a synchrnizatin prfile causes the database fr the prfile t be cleared. This clears the sync database, nt the prfile prperties. If there are multiple prfiles fr the same AD Surce and ne f the prfiles is reset, all data fr the AD Surce is deleted in the SQL database. T reset a synchrnizatin prfile: 1. Select a prfile yu wish t reset. 2. Click Reset Prfile. 3. Click Yes t cnfirm. The prfile is reset. 50

51 Sectin 3. Running Sync Reprts Overview The Sync Reprt has tw primary functins. The first is as an analytical tl used prir t synchrnizing bjects int a target directry, and the secnd is as a lgging feature t view the details f each synchrnizatin. Prir t synchrnizing bject int the target, the surce directry(ies) must be analyzed t identify bjects that culd be prblematic. This is a critical step t a successful sync and shuld nt be verlked. The Sync Reprt reads the surce directry(ies) and writes the data int SQL. This is the same actin taken if yu were t initiate a Push cmmand. The surce data is analyzed t determine the result if yu were t Pull the data int the target directry. The Sync reprt shuld be run prir t the first sync, as well as prir t running a sync after yu have made a change t the prfile, t cnfirm the intended results. The Sync Reprt is ppulated time a Sync Prfile is actually run. Infrmatin at the tp f the Sync Reprt will differentiate if the Sync Reprt is a result f a simulatin r a synchrnizatin. r Cmmn issues that must be crrected prir t synchrnizing Active Directries. SMTP Addresses Unique Match Values Duplicate SMTP Addresses - These bjects will be skipped with a warning that the SMTP address is already in SQL.Any bject yu wish t sync must have a valid and unique SMTP Address. Dirsync allws yu t define up t 4 field/attribute pairs t match bjects in the surce t bjects in the target. If the surce value matches t mre the ne target bject value, Dirsync will skip the bject. This must be crrected if yu intend fr this bject t synchrnize t the target directry. The Sync Reprt allws yu t see the matched bject between the surce and target. These shuld be reviewed t ensure that yur match criteria are valid fr yur envirnment. Running a Sync Reprt T run a Sync Reprt: 1. Once yu have created a prfile, click the Sync Reprt buttn. This pens the Sync Reprt windw. The example in this sectin is a Dmin t Active Directry prfile. 51

52 2. Click Run Simulatin and Yes t cnfirm. Click the Refresh buttn t ppulate the UI with the mst recent data. A sync reprt perfrms a Push int SQL, s it is imprtant that yu reset the prfile prir t running a sync if yu have made changes t the surce data r the prfile settings. If yu d nt clear the prfile, the data that is in SQL frm the Sync Reprt will be pulled t the target directry. Objects tab The Objects tab cntains all f the bjects in the surce and the actin that wuld have been taken had the prfile been synched t the target. All f the clumns can be srted, filtered r rerdered (drag and drp). Review bjects that were skipped in the Operatins clumn, as well as warnings in the Status clumn. Yu can duble click n entry t pen the details fr that bject. The Details windws displays all f the details fr the bject, including the attributes and values that wuld be written t Active Directry. The Internal Fields tab displays the values that are written t SQL. Once crrected, yu can run anther sync reprt t validate the changes. 52

53 Object Issues tab The Object Issues is a filtered list shwing all issues wuld have ccurred during a simulatin r all issues that did ccur during a synchrnizatin. 53

54 Members tab The Members tab displays details fr grup synchrnizatin. Here yu can see each member f all f the grups that wuld be synched t Active Directry. Yu can filter the Status clumn fr warnings t easily view issues that shuld be reslved. The mst cmmn reasn that a member f a distributin list cannt be added t the target distributin list is because the member is nt in the surce Dmain. See the example belw. 54

55 Member Issues tab The Member Issues is a filtered list shwing all issues wuld have ccurred during a simulatin r all issues that did ccur during a synchrnizatin. Object Summary tab The Object Summary tab displays a summary f each bject type, the peratin perfrmed, the status and the bject cunt. 55

56 Members Summary tab The Members Summary tab displays a summary f grup membership synchrnizatin. It displays the number f members added t grups, number f skipped members and the ttal number f errrs r warnings. Prfile tab The Prfile tab lists all f the settings fr the prfile fr which the Sync was run. This can be easily exprted fr trubleshting purpses. 56

57 Surce DCs tab This tab appears n AD t Dmin r AD t AD prfiles nly and displays the Dmain Cntrllers listed in the Surce AD tab f the prfile. Target DCs tab The Target DCs tab will display all f the Dmain Cntrllers cnfigured in the Target DCs tab. It als shws the pririty in which they will be used. The default will always be used unless it is unreachable. 57

58 Sectin 4. Running Directry Sync There are fur ways t run Directry Sync: Scheduling Directry Sync t run prgrammatically by defining a schedule fr the synchrnizatin prfile t run. See Cnfiguring Active Directry Synchrnizatin fr mre inf. Manually starting synchrnizatin by selecting a prfile and clicking the Sync Prfile buttn. Manually starting a synchrnizatin prcess by right-clicking n a prfile and selecting a synchrnizatin ptin. Manually run Directry Sync cmmands frm a cmmand line. 4.1 Manually Starting a Synchrnizatin using a Sync Prfile A synchrnizatin r sync reprt f a prfile cannt be started if a synchrnizatin r sync reprt f the prfile is already running. T manually start synchrnizatin: 1. Select a prfile t synchrnize. 2. Click Sync Prfile. The synchrnizatin is started. This runs a cmplete sync f the prfile (push/pull). 4.2 Manually Starting a Synchrnizatin Prcess using the Right- Click Menu A synchrnizatin r sync reprt f a prfile cannt be started if a synchrnizatin r sync reprt f the prfile is already running. T manually start a synchrnizatin prcess: 1. Right-click a prfile t synchrnize. 2. Click ne f the fllwing ptins: Push - Pushes all changed entries in the surce t SQL Pull - Pulls all changed entries frm SQL t the target Repush - Pushes all surce entries regardless f mdificatin date t SQL (the prfile is reset prir t running a Push r a full Sync) Repull - Same as a Pull and will nly pull changed bjects r bjects that need t be resynced (fr example, because they failed n a prir pull) Repushpull - Cmbines the Repush and Repull cmmands int ne step (the prfile is reset prir t running a Push r a full Sync) Cancel - Cancels a Sync 58

59 Validate - Verifies that yur prfile settings are crrect Cpy - Creates a cpy f the selected prfile Exprt - Exprts the selected prfile 4.3 Manually Starting a Synchrnizatin Prcess frm a Cmmand Line A synchrnizatin r sync reprt f a prfile cannt be started if a synchrnizatin r sync reprt f the prfile is already running. T manually start a synchrnizatin prcess frm a cmmand line: 1. Open a Cmmand Prmpt windw. 2. Navigate t %Prgram Files%\Binary Tree\Dirsync Cmmand binarytree.dirsync.exchange.exe /validate <Prfile ID> binarytree.dirsync.exchange.exe /push <Prfile ID> binarytree.dirsync.exchange.exe /pull <Prfile ID> binarytree.dirsync.exchange.exe /repush <Prfile ID> binarytree.dirsync.exchange.exe /repull <Prfile ID> binarytree.dirsync.exchange.exe /repushpull <Prfile ID> binarytree.dirsync.exchange.exe /pushpull <Prfile ID> binarytree.dirsync.exchange.exe /sync <Prfile ID> binarytree.dirsync.exchange.exe /resync <Prfile ID> Descriptin Verifies that yur settings are crrect Pushes all changed entries in the surce t SQL Pulls all changed entries frm SQL t the target Pushes all surce entries regardless f mdificatin date t SQL Same as a Pull and will nly pull changed bjects r bjects that need t be resynced Cmbines the /repush and /repull cmmands int ne step Cmbines the /push and /pull cmmands int ne step Perfrms the equivalent f a /pushpull n all saved prfiles withut prmpting the user t select ne Perfrms the equivalent f a /repushpull n all saved prfiles withut prmpting the user t select ne Binary Tree recmmends that yu remve existing bjects frm the target OU befre running Repush, Repull, r Repushpull. If yu d nt include a Prfile ID in the cmmand, yu will be prmpted t chse ne. 59

60 Sectin 5. Using the SMART Directry Sync Lg Viewer t View Lgs and Audits The SMART Directry Sync Lg Viewer allws yu t view, search, exprt, and clear synchrnizatin lgs and audit reprts n changes t all items in the target envirnment. T pen and view lgs and audits in the SMART Directry Sync Lg Viewer: 1. In the SMART Directry Sync Cnsle, click the View Lgs and Auditing buttn. The SMART Directry Sync Lg Viewer pens. 2. Select the Lgs tab t view the synchrnizatin lgs r the Audits tab t view the audit reprts. 3. The Synchrnizatin prfile is autmatically selected and lg entries assciated with the prfile are displayed. T change the prfile, select a different prfile frm the Prfile drp-dwn list. Click the Refresh icn next t the Prfile drp-dwn list t refresh the list f prfiles and the lg grid. 5.1 Searching Lg r Audit Entries T search fr lg r audit entries: Enter a search term in the Search field and then click the Find icn. The table refreshes t shw the search results. 5.2 Pausing a Lg Yu can stp the cntinuus scrlling f the lg t allw fr easier reading. This feature pauses the display nly, nt the lgging functin. T pause the lg: 1. Click the Pause icn. 2. T restart the lg display, click the Play icn (next t Paused ). 60

61 5.3 Shwing Lg r Audit Entries fr a Time Perid T shw all lg r audit entries fr a time perid: Select a Shw... ptin frm the drp-dwn list near the upper right crner f the cnsle. The table refreshes t shw all lg r audit entries fr the selected time perid. 5.4 Filtering the Lg r Audits T filter the lg r audit: 1. Click the filter buttn n clumn header t pen the filter windw. 2. Enter the filter criteria, and then click Filter. The table refreshes t the filtered lg entries. 3. User the Clear Filter buttn t clear the filter. 61

62 5.5 Gruping the Lg r Audits by Clumn T grup the lg r audits by a clumn: Drag a clumn header t the bar abve the lg table t grup the lg by a specific clumn. The table refreshes gruped by the selected clumn. 5.6 Viewing Lg r Audit Entry Details T view lg r audit entry details: Click the plus icn in the lg r audit entry. The entry expands t display the details f the lg r audit entry. Lg entries: Audit entries: Audit lg displaying ne entry: 62

63 Audit lg displaying mdified attributes: 5.7 Exprting Lg r Audit Entries T exprt the lg r audit entries f the currently selected prfile: 1. Click Exprt All. 2. Enter a File name, lcatin, a file type, and then click Save. 5.8 Clearing Lg Entries T clear ld lg entries f the currently selected prfile: 1. Click Clear. The Clear Lg windw pens. 2. Select a number and time unit (Weeks, Days, r Hurs) frm the drp-dwn list t clear the lg r audits f lder entries and then click OK. 3. Als fr Lg entries, yu have the ptin t clear the lg entries f all prfiles lder than the selected time autmatically by selecting Clear lg autmatically. The Clear Lg Autmatically ptin is nt available fr Audits. Binary Tree recmmends that the lgs be set t clear autmatically t prevent the accumulated data frm becming t large. 63

64 T clear all lg and audit entries f the currently selected prfile: 1. Click Clear All. All lg r audit entries f the currently selected prfile are cleared. If an Audit Lg is cleared, the fllwing is an example f the recrd that will be displayed shwing that the entries were remved (cleared). 64

65 Sectin 6. Updating the Grups t Ignre List in SQL By default, Directry Sync is cnfigured with a list f typical AD and Exchange security grups that will nt be synchrnized. Yu can update the Grups t Ignre List in SQL by using either the SQL Server Management Studi (SSMS) r the SQL Imprt and Exprt Data tl. Yu may als chse t nt synchrnize Security grups via the Grup Filter, which will prevent all grups matching the criteria frm being entered int SQL. This must be cnfigured befre the initial synchrnizatin, r yu will have t remve all the security grups frm SQL and AD prir t using this ptin. 6.1 Default List f Grups in the Grups t Ignre List fr Active Directry Synchrnizatin The default list f grups in the Grups t Ignre List includes: NT Authrity Dialup Netwrk Batch Interactive Lgn Sessin Service Annymus Prxy Enterprise Dmain Cntrllers Principal Self Authenticated Users Restricted Cde Terminal Server Users Remte Interactive Lgn This Organizatin Lcal System NT Authrity Administratr Guest KRBTGT Dmain Admins Dmain Users 65

66 Dmain Guests Dmain Cmputers Cert Publishers Schema Admins Enterprise Admins Grup Plicy Creatr Owners RAS and IAS Servers Administratrs Users Guests Pwer Users Accunt Operatrs Server Operatrs Print Operatrs Backup Operatrs Replicatrs NTLM Authenticatin SChannel Authenticatin Digest Authenticatin NT Service Untrusted Mandatry Level Delegated Setup Discvery Management Exchange All Hsted Organizatins Exchange Organizatin Administratrs Exchange Public Flder Administratrs Exchange Recipient Administratrs Exchange Servers Exchange Trusted Subsystem Exchange View-Only Administratrs Exchange Windws Permissins ExchangeLegacyInterp Hygiene Management Organizatin Management Public Flder Management Recipient Management 66

67 Recrds Management Server Management UM Management View-Only Organizatin Management Updating Grups t Ignre List in SQL By default, Directry 6.2 Updating the Grups t Ignre List with the SQL Server Management Studi (SSMS) Perfrm the fllwing steps frm SSMS t add r remve grups frm the Grups t Ignre List in SQL. This prcess is preferred if yu have a small number f changes t make. Refer t Updating the Grups t Ignre List via the SQL Imprt and Exprt Data Tl fr larger updates. T add r remve grups frm the Grups t Ignre List in SQL: 1. Launch the SQL Server Management Studi. 2. Navigate t the BTCdex server and database, expand Tables, and then right click n the db.dirsync_grupstignre. 3. Select Edit Tp 200 Rws frm the list. 4. Add new entries at the bttm. 5. If yu have mre than 200 grups t ignre, yu can increase the number f rws shwn: a. Run the SQL Server Management Studi. b. Click Tls -> Optins c. Select SQL Server Object Explrer. Nw yu shuld be able t see the Table and View ptins: Value fr Edit Tp Rws Cmmand Value fr Select Tp Rws Cmmand 67

68 d. Set the Values t 0 t edit and select all the recrds. 6. The table displays the Select All Rws and Edit All Rws ptins. 68

69 6.3 Updating the Grups t Ignre List with the SQL Imprt and Exprt Tl T use the SQL Imprt and Exprt Data tl t update the Grups t Ignre List in SQL: 1. Expand the Micrsft SQL Server 2008 R2 flder and select Imprt and Exprt Data (32-bit). 2. Select the data surce frm which yu want t cpy data, and then click Next. 3. Select the destinatin where data is t be cpied. 69

70 4. Select Cpy data frm ne r mre tables r views, and then click Next t cntinue. 5. Chse ne r mre tables and views t cpy, and then click Edit Mappings. 70

71 6. Select Append rws t the destinatin table and fill in the values in the Destinatin clumn, then click OK. 7. Select Run immediately and then click Finish. 6.4 Excluding Security Grups frm Synchrnizatin with the Grup Filter Select the apprpriate Prfile and Surce OU in the Directry Sync UI and duble-click n Grup Filter n the AD Surce tab. Replace (bjectclass=grup) with (bjectclass=grup)(!gruptype:= ) and click Save. 71

72 Binary Tree recmmends that yu use the Active Directry Users and Cmputers management cnsle t test yur filters t prevent Directry Synchrnizatin frm failing due t an invalid filter. 72

73 Appendix A: Supprting a Mixed Exchange 2003/ 2007/2010/2013/2016 Envirnment Synchrnizing Rms frm Exchange 2003 t Exchange 2010 Due t the differences in the management f Rms between Exchange 2003 and Exchange 2010, a custm mapping is required fr Rms frm an Exchange 2003 surce t appear as a Rm bject in a target Exchange 2010 envirnment. The fllwing fields must appear in the target Rm bjects fr them t display as Rms. Attribute Value MSExchResurceDisplay MSExchResurceMetaData MSExchResurceSearchPrperties Rm Resurce Type: Rm Rm MSExchResurceDisplayType 7 MSExchResurceRecipientTypeDetails 16 The Rm must be a mailbx enabled bject in the surce AD and cannt be a Public Flder Binary Tree des nt recmmend manually editing attributes frm the target directry. All updates shuld be frm the authritative surce directry r via custm mapping There must be an identifying attribute in the surce bject that is used t distinguish these bjects as Exchange 2003 Rms. Fr this example, we have set the extensin Attribute1 t btrm. T custmize the mapping s that Exchange 2003 rms appear as rms in Exchange 2010: 1. Frm the Mapping tab, click Overrides. The View Overrides windw appears. 73

74 3. Click Add. The Override dialg appears. 4. Select a Persn r Grups frm the View drp-dwn list. 5. Enter the fllwing values: FieldName: Enter the name f the field frm the view that yu want t verride (TargetAddress, BTCustm001, and s n) FieldValue: Enter the SQL statement that is used t calculate the value fr the field. View Field Name Field Value Persn as msexchresurcedisplay CASE WHEN P.msExchResurceDisplay IS NOT NULL THEN P.msExchResurceDisplay ELSE (CASE P.Extensin1 WHEN 'btrm' THEN 'Rm' ELSE NULL END) END Persn msexchresurcemetadata CASE WHEN P.msExchResurceMetaData IS NOT NULL THEN P.msExchResurceMetaData ELSE (CASE P.Extensin1 WHEN 'btrm' THEN 'ResurceType:Rm' ELSE NULL END) END Persn msexchresurcesearchprperties CASE WHEN P.msExchResurceSearchPrperties IS NOT NULL THEN P.msExchResurceSearchPrperties ELSE (CASE P.Extensin1 WHEN 'btrm' THEN 'Rm' ELSE NULL END) END 74

75 View Field Name Field Value Persn msexchrecipientdisplaytype CASE WHEN P.msExchRecipientDisplayType IS NOT NULL THEN P.msExchRecipientDisplayType ELSE (CASE P.Extensin1 WHEN 'btrm' THEN '7' ELSE NULL END) END Persn msexchrecipienttypedetails CASE WHEN P.msExchRecipientTypeDetails IS NOT NULL THEN P.msExchRecipientTypeDetails ELSE (CASE P.Extensin1 WHEN 'btrm' THEN '16' ELSE NULL END) END 6. Yu can nw synchrnize Rms frm Exchange 2003 t Exchange Once these rms are in the target directry, g t the Exchange Management Cnsle (EMC) in the target 2010 envirnment. 8. Expand the Organizatin Cnfiguratin flder, select Mailbx, and then select All Rms. 9. Right click n All Rms and then select Apply. 75

76 10. Click Next and then Finish t reapply the address list. 76

77 Appendix B: Additinal Cnfiguratin Optins Changing the attribute used fr "Created by Dirsync" r "Updated by Dirsync" By default, the admindescriptin attribute is stamped n bjects n the Target that are created r updated by SMART Directry Sync with "Created by Dirsync" r "Updated by Dirsync" t define which bjects can be safely deleted frm the Target. An app setting is available in the cnfig file t allw yu t define a different attribute/field fr this purpse. T use an attribute ther than admindescriptin, define a new DirSyncAttribute setting in the <appsettings> sectin f the cnfig file. Fr example, the belw setting will use admindisplayname instead f admindescriptin: Warning: This must be cnfigured befre the initial sync. <appsettings> <add key="dirsyncattribute" value="admindisplayname"/> </appsettings> Setting msexchrecipientdisplaytype and msexchrecipienttypedetails Exchange attributes A cnfiguratin ptin t allw yu t set msexchrecipientdisplaytype and msexchrecipienttypedetails Exchange attributes based n the value f a cnfigurable attribute is available. The cnfiguratin ptin must defined in the <appsettings> sectin f the cnfig file, as shwn belw. Value= shuld cntain the attribute t be used. (prxyaddresses shwn belw). If the value f the attribute is null, msexchrecipientdisplaytype and msexchrecipienttypedetails will be ppulated. See the list belw fr the values that will be ppulated. <appsettings> <add key="recipienttype_mailenabledattribute" value="prxyaddresses"/> </appsettings> Mail Enabled Users in the surce: msexchrecipientdisplaytype = 6 msexchrecipienttypedetails = 128 Rm Mailbx in the surce: msexchrecipientdisplaytype = 7 msexchrecipienttypedetails = 16 Resurce Mailbx in the surce: msexchrecipientdisplaytype = 8 msexchrecipienttypedetails = 32 77

78 Shared Mailbx in the surce: msexchrecipientdisplaytype = 0 msexchrecipienttypedetails = 4 Allw bjects with remte mailbxes t be treated as mailbx-enabled bjects A setting that allws bjects with remte mailbxes t be treated as mailbx-enabled bjects is available. T enable this feature, add the Remt bxAsMailbxEnabled ptin t the <appsettings> sectin f the BinaryTree.DirSync.Exchange.exe.cnfig file as displayed belw. <appsettings> <add key="remt bxasmailbxenabled" value="true"/> </appsettings> If this setting is set t value ther than True r if mitted frm the file, bjects with remte mailbxes will be treated as nn-mailbx-enabled. If set t True, bjects with remte mailbxes will be treated as mailbx-enabled. Specify a timeut fr passwrd sync A cnfiguratin ptin in the appsettings sectin f the cnfig file t specify a timeut fr passwrd sync is available. In large envirnments, it may take lnger than the default 300 secnd timeut t cmplete the passwrd sync prcess and may need t be lengthened. This setting shuld be added t the BinaryTree.DirSync.Exchange.exe.cnfig file. <appsettings> <add key="passwrdsynctimeutsecnds" value="300"/> </appsettings> Set the value t cnfigure the timeut t a specific number f secnds. If this setting is mitted, r set t an invalid value, the timeut will be set t 300 secnds (5 minutes). T disable the timeut functinality, set t -1 (r negative value). Disable the caching f grup members A cnfiguratin ptin can be used in the appsettings sectin f the cnfig file t disable the caching f grup members. This setting shuld be added t the BinaryTree.DirSync.Exchange.exe.cnfig file. <appsettings> <add key="optimizegrupsyncmemryusage" value="true"/> </appsettings> Valid values are true and false. If this setting is mitted, r set t an invalid value, the value defaults t false. If set t false, grup members will be cached during push and pull. If set t true, grup members will nt be cached during push and pull. 78

79 Disable the initializatin f the sync reprt A cnfiguratin ptin can be used in the appsettings sectin f the cnfig file t disable the initializatin f the sync reprt. If disabled, a sync reprt will still be recrded, but it will nt be initialized between syncs. The result will be that an bject will shw data frm the last time it was prcessed by SMART Directry Sync, rather than just the mst recent time it was prcessed. In ther wrds, if an bject is inserted during a sync, it will shw in the sync reprt as Inserted. Assuming a secnd sync des nt tuch this bject, then if the sync reprt is initialized, a secnd sync will shw this bject as N Change, but if the sync reprt is nt initialized, the bject will still shw as Inserted. This setting shuld be added t the BinaryTree.DirSync.Exchange.exe.cnfig file. <appsettings> <add key="disablesyncreprtinitializatin" value="true"/> </appsettings> Valid values are true and false. If this setting is mitted, r set t an invalid value, the value defaults t false. If set t false, the sync reprt will be initialized. If set t true, the sync reprt will nt be initialized. Set the maximum number f users and grups synced simultaneusly During pull prcessing, SMART Directry Sync will sync multiple Active Directry user and grup bjects simultaneusly int the target AD. The maximum number f users and grups synced simultaneusly can be changed using the ThreadCunt setting in the cnfig file. If this cnfiguratin ptin is nt specified, the ThreadCunt will be set t the same number f lgical prcessr cres f the server n which SMART Directry Sync is running. The cnfiguratin ptin is nt included by default. T add, mdify the BinaryTree.DirSync.Exchange.exe.cnfig file lcated at C:\Prgram Files\Binary Tree\DirSync and add a new key t the <appsettings> sectin as fllws: <appsettings> <add key="threadcunt" value="4"/> </appsettings> This ptin shuld never be set t a number greater than the number f prcessr cres n the server. Hwever, yu may need t specify a lwer number if ther applicatins als running n the server require a specific number f cres set aside fr prcessing. Best practice is t leave the setting at the default value and lwer it nly if additinal prcessing pwer is needed fr ther applicatins n the server. 79

80 Appendix C. Using the User, Grup, and Device LDAP filters Active Directry prvides a pwerful way f retrieving data thrugh the use LDAP filters. Directry Synchrnizatin expses three filters during the creatin f a synchrnizatin prfile: User OU Filter, Grup OU Filter, and Device OU Filter whse defaults are: Users: (&(!(admindescriptin=created By DirSync))( (bjectclass=persn)(bjectclass=rm))(!(bjectclass=cmputer))) Grups: (&(!(admindescriptin=created By DirSync))(bjectClass=Grup)) Devices: (&(!(admindescriptin=created By DirSync))(bjectClass=cmputer)(!(primaryGrupID=516))) These filters are per rganizatinal unit and apply t sub-ous when the Sync Sub-OUs ptin is selected. Mdifying these filters requires a basic understanding f the attributes, their value representatins, and their data types. LDAP filters supprt number f ptins including filtering by date ranges, wildcards, and the use f bitmasks as in the useraccuntcntrl prperty. The use f the bjectclass and bjectcategry prperties can greatly reduce the number f recrds retrieved resulting in imprved perfrmance. Yu may use ther attributes t further restrict yur results. The fllwing are cmmn examples f queries and their LDAP query syntax. Selecting users that are part f the Accunting department: (&(bjectclass=user)(bjectcategry=persn)(department=accunting)) Selecting mailbx-enabled users: (&(bjectclass=user)(bjectcategry=persn)(hmemdb=*)) Selecting mail-enabled users and cntacts: ( (&(bjectclass=user)(bjectcategry=persn)(!hmemdb=*))(bjectclass=cntact)) Selecting users created after January 1, 2011: (&(bjectclass=user)(bjectcategry=persn)(whencreated>= z)) Selecting distributin lists: (&(bjectclass=grup)(gruptype=2)) Binary Tree recmmends that yu use the Active Directry Users and Cmputers management cnsle t test yur filters t prevent Directry Synchrnizatin frm failing due t an invalid filter. 80

81 Appendix D: Default Mapping The belw table displays the default values f the AD Surce t AD Target mapping table. Surce Field Internal Field Target Field S urc e Ty pe Tar get Typ e 1 Tar get Typ e 2 Cmments accuntexpires AccuntExpires accuntexpires altrecipient FrwardingAddress altrecipient assistant Assistant authorig AuthOrig authorig C CuntryAbbreviatin C cn CmmnName cn C CuntryName C cdepage CdePage cdepage Cmment Cmment Cmment cmp Cmp cmp cuntrycde CuntryCde cuntrycde deleteditemflags DeletedItemFlags deleteditemflags delivcntlength DelivCntLength delivcntlength department Department department departmentnumber DepartmentNumber departmentnumber descriptin Descriptin descriptin displayname DisplayName displayname divisin Divisin divisin dlmemsubmitperms DLMemSubmitPerms dlmemsubmitperms dlmemrejectperms DLMemRejectPerms dlmemrejectperms 81

82 Surce Field Internal Field Target Field S urc e Ty pe Tar get Typ e 1 Tar get Typ e 2 Cmments emplyeeid EmplyeeID emplyeeid emplyeenumber EmplyeeNumber emplyeenumber emplyeetype EmplyeeType emplyeetype expiratintime ExpiratinTime expiratintime extensinattribute1 Extensin1 extensinattribute1 These are Exchange defined custm attributes. extensinattribute10 Extensin10 extensinattribute10 These are Exchange defined custm attributes. extensinattribute11 Extensin11 extensinattribute11 These are Exchange defined custm attributes. extensinattribute12 Extensin12 extensinattribute12 These are Exchange defined custm attributes. extensinattribute13 Extensin13 extensinattribute13 These are Exchange defined custm attributes. extensinattribute14 Extensin14 extensinattribute14 These are Exchange defined 82

83 Surce Field Internal Field Target Field S urc e Ty pe Tar get Typ e 1 Tar get Typ e 2 Cmments custm attributes. extensinattribute15 Extensin15 extensinattribute15 These are Exchange defined custm attributes. extensinattribute2 Extensin2 extensinattribute2 These are Exchange defined custm attributes. extensinattribute3 Extensin3 extensinattribute3 These are Exchange defined custm attributes. extensinattribute4 Extensin4 extensinattribute4 These are Exchange defined custm attributes. extensinattribute5 Extensin5 extensinattribute5 These are Exchange defined custm attributes. extensinattribute6 Extensin6 extensinattribute6 These are Exchange defined custm attributes. extensinattribute7 Extensin7 extensinattribute7 These are 83

84 Surce Field Internal Field Target Field S urc e Ty pe Tar get Typ e 1 Tar get Typ e 2 Cmments Exchange defined custm attributes. extensinattribute8 Extensin8 extensinattribute8 These are Exchange defined custm attributes. extensinattribute9 Extensin9 extensinattribute9 These are Exchange defined custm attributes. facsimiletelephnenumb er OfficeFAXNumber facsimiletelephnenumb er generatinqualifier Suffix generatinqualifier givenname FirstName givenname hmephne HmePhneNumber hmephne HmePstalAddress HmePstalAddress HmePstalAddress Inf Inf Inf initials Initials initials internatinalisdnnumbe r InternatinalISDNNumbe r internatinalisdnnumbe r 84

85 Surce Field Internal Field Target Field S urc e Ty pe Tar get Typ e 1 Tar get Typ e 2 Cmments internetencding internetencding internetencding ipphne IPPhne ipphne jpegpht JPEGPht jpegpht l OfficeCity l language Language language legacyexchangedn LegacyExchangeDN legacyexchangedn Created using the surce bject's GUID as the CN. lcaleid LcaleID lcaleid mail InternetAddress mail mailnickname PrimaryAlias mailnickname manager Manager mapirecipient MAPIRecipient mapirecipient middlename MiddleName middlename mbile CellPhneNumber mbile msds- PhneticCmpName msdsphneticcmp Name msds- PhneticCmpName 85

86 Surce Field Internal Field Target Field S urc e Ty pe Tar get Typ e 1 Tar get Typ e 2 Cmments msds- PhneticDepartment msdsphneticdepartme nt msds- PhneticDepartment msds- PhneticDisplayName msdsphneticdisplayna me msds- PhneticDisplayName msds- PhneticFirstName msdsphneticfirstname msds- PhneticFirstName msds-phneticlastname msdsphneticlastname msds-phneticlastname msexchaddressbkflag s msexchaddressbkflag s msexchaddressbkflag s msexchalobjectversin msexchalobjectversin msexchalobjectversin msexcharchiveguid msexcharchiveguid msexcharchiveguid msexcharchivename msexcharchivename msexcharchivename msexchassistantname msexchassistantname msexchassistantname msexchblckedsendersh ash msexchblckedsendersh ash msexchblckedsendersh ash msexchbypassaudit msexchbypassaudit msexchbypassaudit msexchelcexpirysuspen sinend msexchelcexpirysuspen sinend msexchelcexpirysuspen sinend msexchelcexpirysuspen sinstart msexchelcexpirysuspen sinstart msexchelcexpirysuspen sinstart 86

87 Surce Field Internal Field Target Field S urc e Ty pe Tar get Typ e 1 Tar get Typ e 2 Cmments msexchelcmailbxflags msexchelcmailbxflags msexchelcmailbxflags msexchexternaloofopti ns msexchexternaloofopti ns msexchexternaloofopti ns msexchhidefrmaddress Lists msexchhidefrmaddress Lists msexchhidefrmaddress Lists msexchmailbxauditena ble msexchmailbxauditena ble msexchmailbxauditena ble msexchmailbxauditlg AgeLimit msexchmailbxauditlg AgeLimit msexchmailbxauditlg AgeLimit msexchmailbxguid msexchmailbxguid msexchmailbxguid msexchmdbrulesquta msexchmdbrulesquta msexchmdbrulesquta msexchmessagehygiene Flags msexchmessagehygiene Flags msexchmessagehygiene Flags msexchmessagehygiene SCLDeleteThreshld msexchmessagehygiene SCLDeleteThreshld msexchmessagehygiene SCLDeleteThreshld msexchmessagehygiene SCLJunkThreshld msexchmessagehygiene SCLJunkThreshld msexchmessagehygiene SCLJunkThreshld msexchmessagehygiene SCLQuarantineThreshld msexchmessagehygiene SCLQuarantineThreshld msexchmessagehygiene SCLQuarantineThreshld msexchmessagehygiene SCLRejectThreshld msexchmessagehygiene SCLRejectThreshld msexchmessagehygiene SCLRejectThreshld 87

88 Surce Field Internal Field Target Field S urc e Ty pe Tar get Typ e 1 Tar get Typ e 2 Cmments msexchmderatinflags msexchmderatinflags msexchmderatinflags msexchpliciesexcluded msexchpliciesexcluded msexchpliciesexcluded msexchpliciesincluded msexchpliciesincluded msexchpliciesincluded msexchprvisiningflags msexchprvisiningflags msexchprvisiningflags msexchrecipientdisplayt ype msexchrecipientdisplayt ype msexchrecipientdisplayt ype This mapping is ignred and msexchrecipie ntdisplaytype is set t 6 when the prfile is set t sync users as Mail- Enabled Users r Disabled Mail-Enabled Users, r the prfile is set t sync users As- Is and the bject in the surce is Mailbx- Enabled. msexchrecipienttypedet ails msexchrecipienttypedet ails msexchrecipienttypedet ails This mapping is ignred and msexchrecipi enttypedetai ls is set t 128 when the prfile is set t sync users as Mail- 88

89 Surce Field Internal Field Target Field S urc e Ty pe Tar get Typ e 1 Tar get Typ e 2 Cmments Enabled Users r Disabled Mail-Enabled Users, r the prfile is set t sync users As-Is and the bject in the surce is Mailbx- Enabled. msexchrequireauthtse ndt msexchrequireauthtse ndt msexchrequireauthtse ndt msexchresurcecapacity msexchresurcecapacity msexchresurcecapacity msexchresurcedisplay msexchresurcedisplay msexchresurcedisplay msexchresurcemetadat a msexchresurcemetadat a msexchresurcemetadat a msexchresurcesearchp rperties msexchresurcesearchp rperties msexchresurcesearchpr perties msexchsaferecipientsha sh msexchsaferecipientsha sh msexchsaferecipientsha sh msexchsafesendershash msexchsafesendershash msexchsafesendershash msexchtransprtrecipie ntsettingsflags msexchtransprtrecipie ntsettingsflags msexchtransprtrecipie ntsettingsflags 89

90 Surce Field Internal Field Target Field S urc e Ty pe Tar get Typ e 1 Tar get Typ e 2 Cmments msexchumdtmfmap msexchumdtmfmap msexchumdtmfmap msexchumspkenname msexchumspkenname msexchumspkenname msexchuserculture msexchuserculture msexchuserculture msexchversin msexchversin msexchversin name Name name O O O bjectguid AdminDisplayName admindisplayname therfacsimiletelephne Number OtherFacsimileTelephne Number therfacsimiletelephne Number therhmephne OtherHmePhne therhmephne theripphne OtherIpPhne theripphne thermbile OtherMbile thermbile therpager OtherPager therpager thertelephne OtherTelephne thertelephne pager PagerNumber pager persnalpager PersnalPager persnalpager 90

91 Surce Field Internal Field Target Field S urc e Ty pe Tar get Typ e 1 Tar get Typ e 2 Cmments persnaltitle PersnalTitle persnaltitle Pht Pht Pht physicaldeliveryofficena me Lcatin physicaldeliveryofficena me Imprtant, particularly fr printers. popcharacterset POPCharacterSet popcharacterset popcntentfrmat POPCntentFrmat popcntentfrmat pstaladdress PstalAddress pstaladdress pstalcde OfficeZip pstalcde pstofficebx PstOfficeBx pstofficebx preferreddeliverymethd PreferredDeliveryMethd preferreddeliverymethd primaryinternatinalisdn Number PrimaryInternatinalISDN Number primaryinternatinalisdn Number primarytelexnumber PrimaryTelexNumber primarytelexnumber prxyaddresses PrxyAddresses PrxyAddresse s cntains the InternetAddres s as the primary SMTP, the legacyexchang edn f bth the surce and 91

92 Surce Field Internal Field Target Field S urc e Ty pe Tar get Typ e 1 Tar get Typ e 2 Cmments target as X500 addresses, and plicies frm the target (if enabled). pwdlastset PwdLastSet rmnumber RmNumber rmnumber samaccuntname SAMAccuntName samaccuntname The fllwing restricted chars will be replaced with underscres:, + " < > ; = / [ ] : *? \ shwinadvancedviewonl y ShwInAdvancedViewOnl y shwinadvancedviewonl y sn LastName sn Smetimes used as surname. st OfficeState st street Street street streetaddress OfficeStreetAddress streetaddress telephneassistant TelephneAssistant telephneassistant telephnenumber OfficePhneNumber telephnenumber 92

93 Surce Field Internal Field Target Field S urc e Ty pe Tar get Typ e 1 Tar get Typ e 2 Cmments terminalserver TerminalServer terminalserver textencdedoraddress TextEncdedORAddress textencdedoraddress thumbnaillg ThumbnailLg thumbnaillg thumbnailpht * ThumbnailPht * thumbnailpht * title JbTitle title unauthorig UnauthOrig unauthorig url WebSite url usercert UserCert usercert usercertificate UserCertificate usercertificate userprincipalname UserPrincipalName userprincipalname usersmimecertificate UserSMIMECertificate usersmimecertificate wwwhmepage WWWHmePage wwwhmepage managedby ManagedBy gr up gr up cnt act gruptype GrupType gruptype gr up gr up * thumbnailpht values are synced directly frm the Surce t the Target. 93

94 Appendix E: Custmizing Overrides In SMART Directry Sync, an verride is used t transfrm values in the target directry based upn a frmula. The frmula language used is T-SQL, used in Micrsft s SQL Server prduct line. A valid select statement in T-SQL wuld be Select (FirstName + LastName) frm BT_Persn. When adding an verride yu d nt need t include a full SQL select statement as prtins f the SQL statement are generated fr yu. Specifically, yu are nt required t use the select r frm cmmands in the verride. It is nly required t enter the clumns that shuld be selected. T cntinue the example abve, a valid verride wuld nly need t cntain the value f FirstName + LastName. T add a View Override: 1. Frm the Mapping tab, click Overrides. The View Overrides windw appears. 2. Click Add. The Override dialg appears. 3. Select a Persn r Grups frm the View drp-dwn list. 4. Enter a Field Name fr the new verride. This must be a valid internal field name in SQL. 5. Enter a Field Value fr the new verride. This must be a crrectly frmatted SQL statement. 6. Enter Cmments fr the new verride. 7. Click Save. 8. Click Yes fr the cnfirmatin message. 94

95 When yu save an verride, SMART Directry Sync re-generates the Persn r Grups view. It des this by dynamically generating a single SQL statement using the snippet f SQL cde that is part f all verrides. The max size fr this SQL statement is 8000 ttal characters. If m new verrides are added, this limit culd be exceeded and an errr when adding the verrides will ccur. In additin t the default verrides, apprximately mre Persn and Grup verrides can be added befre hitting the size limit. T edit a mapping verride: 1. Frm the Mapping tab, click Overrides. The View Overrides windw appears. 2. Select an Override and click Edit. The Override dialg appears. 3. Edit the Field Value fr the verride. The View and Field Name cannt be edited. 4. Edit Cmments fr the verride. 5. Click Save. 6. Click Yes fr the cnfirmatin message. 95

96 T delete a mapping verride: 1. Frm the Mapping tab, click Overrides. The View Overrides windw appears. 2. Select an Override and click Delete. 3. Click Yes fr the cnfirmatin message. T exprt all mapping verrides: 1. Frm the Mapping tab, click Overrides. The View Overrides windw appears. 2. Click Exprt All. 3. Select a lcatin, enter a file name, and click Save. 96

97 Cntrlling actins with Overrides SMART Directry Sync uses the TypeOfTransactin clumn frm the BT_Persn table, r the Operatin clumn frm the BT_Grups table t determine what actin t perfrm n the target bject. These may have verrides applied t them, t cntrl what actins Directry Sync will take fr an bject. The belw image shws an example f this kind f verride. Matching bjects with Overrides The values used fr matching can have verrides applied t them. This is accmplished by setting up a new verride using the field names MatchValue1, MatchValue2, MatchValue3 and MatchValue4. Each MatchValue1-4 crrespnds the respective Surce and Target pair n the matching tab. These values are used fr matching nly. Values that get written t the target are based n the mappings, nt the matching. 97