8.7. Installation Guide

Transcription

1 8.7 Installation Guide

2 2011 Quest Software, Inc. ALL RIGHTS RESERVED. This document contains proprietary information protected by copyright. The software described in this document is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Quest Software, Inc. If you have any questions regarding your potential use of this material, contact: Quest Software World Headquarters LEGAL Dept 5 Polaris Way Aliso Viejo, CA legal@quest.com Refer to our website for regional and international office information. TRADEMARKS Quest, Quest Software, the Quest Software logo are trademarks and registered trademarks of Quest Software, Inc in the United States of America and other countries. For a complete list of Quest Software's trademarks, please see Other trademarks and registered trademarks are property of their respective owners. DISCLAIMER The information in this document is provided in connection with Quest products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest products. EXCEPT AS SET FORTH IN QUEST'S TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Quest does not make any commitment to update the information contained in this document. Quest Migration Manager Updated March 18, 2011 Software version 8.7

3 CONTENTS About This Guide... 3 Introduction... 3 Conventions... 3 What Is Quest Migration Manager?... 4 General... 4 Architecture... 5 Overview... 5 Components... 5 Licensing... 7 Migration Manager for Active Directory... 7 Migration Manager for Exchange... 7 Before You Begin... 8 Preparation Checklist... 8 Pre-Requisites Migration Manager Components and Service Accounts Providing for Resources Availability (Active Directory Migration) Other Pre-Installation Considerations Active Directory Connector Migration Manager and Microsoft Outlook Cluster Support Migration Manager and Backup Utilities Providing Communication Using IP version 4 for Exchange Migration Preparing the Source and Target Environments for Active Directory Migration Step 1: Establish Trusts Step 2: Disable SID Filtering Step 3: Check Host Name Resolution DNS Name Resolution NetBIOS Name Resolution Step 4: Open the Required Ports on Servers, Routers, and Firewalls Step 5: Configure Windows Server 2008 Firewall Preparing the Source and Target Environment for Exchange Migration Step 1: Back up Exchange Step 2: Create Aelita EMW Recycle Bin Public Folder Step 3: Create Mailboxes for Public Folder and Free/Busy Synchronization Connecting the Source and Target Exchange Organizations Using SMTP Connectors Step 1: Set Up the SMTP Connectors Step 2: Force Exchange to Accept Redirected Mail as Inbound Mail Creating a Recipient Policy Step 3: Modify Name Resolution Parameters on the Bridgehead Servers in Exchange 22 Step 4: Configure DNS Step 5: Test the SMTP Connectors i

4 Installing Migration Manager Migration Manager Setup Downloading MAPI CDO Getting Started Opening a Migration Project Step 1: Configure ADAM Database Step 2: Set Auxiliary Account Step 3: Configure SQL/MSDE Database Step 4: Configure Statistics Portal Step 5: Completing the Wizard Analyzing the Environment Glossary About Quest Software, Inc Contacting Quest Software Contacting Quest Support Third Party Contributions Boost 1.0 License Agreement Loki License Agreement Loki License Agreement ZLib License Agreement ii

5 Installation Guide About This Guide Introduction This document has been prepared to assist you in becoming familiar with Quest Migration Manager. It contains the information required to deploy Quest Migration Manager in your organization. It is intended for network administrators, consultants, analysts, and any other IT professionals using the product. Conventions In order to help you get the most out of this guide, we have used specific formatting conventions. These conventions apply to procedures, icons, keystrokes and crossreferences. ELEMENT Select Bolded text Italic text Bold Italic text Blue text CONVENTION This word refers to actions such as choosing or highlighting various interface elements, such as files and radio buttons. Interface elements that appear in Quest products, such as menus and commands. Used for comments. Introduces a series of procedures. Indicates a cross-reference. When viewed in Adobe Acrobat, this format can be used as a hyperlink. Used to highlight additional information pertinent to the process being described. Used to provide Best Practice information. A best practice details the recommended course of action for the best result. Used to highlight processes that should be performed with care. + A plus sign between two keystrokes means that you must press them at the same time. A pipe sign between elements means that you must select the elements in that particular sequence. 3

6 Quest Migration Manager 8.7 What Is Quest Migration Manager? General Quest Migration Manager for Active Directory is an efficient, flexible, and comprehensive solution for restructuring your Active Directory. Migration Manager for Active Directory includes capabilities for pruning and grafting, directory redesign, and Active Directory-to-Active Directory migration. With Migration Manager for Active Directory, major changes to your directory structure can be safely managed with no disruption to daily activities. Quest Migration Manager for Exchange, a companion application to Migration Manager for Active Directory, allows administrators to migrate user mailboxes, public folders, and other Exchange data from one Exchange 2000/2003/2007 organization to another Exchange 2000/2003/2007/2010 organization in a way that is transparent to the end-users and does not impact user productivity. These products are designed to be used together. Throughout this document, Migration Manager applies to both Migration Manager for Active Directory and Migration Manager for Exchange. When a particular component is referenced individually, the information applies only to that component. Unless a specific Exchange version is meant, "Exchange" denotes Exchange 2000, Exchange 2003, Exchange 2007, and Exchange 2010 organizations, servers, mailboxes, etc. This guide will help you in deploying Quest Migration Manager, including planning, environment preparation and product setup. A list of terms and product components named in this document is provided in the Glossary. 4

7 Installation Guide Architecture Overview Migration Manager consists of several components that work together as shown in the figure below: Source Domain Target Domain Accounts migration and directory synchronization Mail, Public Folders, Calendar, Free/Busy Synchronization Agents DC DC Mail, Public Folders, Calendar, Free/Busy Synchronization Agents Exchange data migration and synchronization Exchange Exchange Directory Synchronization Agent ADAM Project partition SQL Configuration database Console Statistics Web Portal Components Active Directory Application Mode Database The Active Directory Application Mode (ADAM) database instance is used to store the migration project information, such as the domain pair configuration, migration and synchronization job configuration, resource processing tasks, and delegation information. SQL Configuration Database The SQL configuration database is used to store Exchange migration project information, such as the source and target Exchange organizations and the agent and job configuration. Console Migration Manager is usually installed on a separate computer (server or workstation) that is referred to as a console. Depending on your environment and requirements, you can manage your migration project using one or multiple consoles. For more information on how many consoles to have, refer to the Managing the Migration Project section of the Migration Manager for Active Directory User Guide. 5

8 Quest Migration Manager 8.7 When you install Migration Manager for Active Directory, the following program components are available: Pre-migration tools, such as Trust Migration Wizard and Site Migration Wizard Directory Synchronization Agent, which allows for both synchronization and migration sessions Resource processing components, including Resource Updating Manager and multiple processing wizards When you install Migration Manager for Exchange, you get the following program components: Directory Synchronization Agent which will allow for synchronization only. Active Directory migration capabilities are disabled if you do not have Migration Manager for Active Directory installed. Exchange data synchronization and migration components, including public folder, calendar, free/busy, and mailbox synchronization agents. If you are migrating both Active Directory and Exchange, you should install both Migration Manager for Active Directory and Migration Manager for Exchange and thus will have both sets of components on your console. A useful additional component is the Client Profile Updating Utility (EMWProf), which redirects Outlook profiles to the new Exchange mailboxes after the migration. This utility is installed separately. Agents All migration tasks are handled by agents. Agents run on remote servers and are managed from the console. Directory synchronization and accounts migration is performed by the Directory Synchronization Agent (DSA). The agent connects to both the source and the target domains when processing directory synchronization and migration jobs. The DSA can run either on a separate server or on the console machine. Depending on your environment, you can use one or several DSAs to migrate Active Directory. DSA configuration and activity is controlled through ADAM. To avoid possible performance and synchronization speed degradation, we do not recommend you install the Directory Synchronization Agents on Exchange servers and domain controllers. Exchange data is migrated by the mail, public folder, calendar, and free/busy synchronization jobs. Each job is processed by a corresponding synchronization agent. Synchronization agents run on source and target Exchange servers and agent hosts and are controlled from the console. (The agent host feature is described in Appendix C of the Migration Manager for Exchange User Guide.) The configuration of the agents and jobs is stored in the SQL configuration database and uploaded to the agents local databases each time it is modified on the console. 6

9 Installation Guide Resource Updating Manager To update distributed resources, such as end-user workstations and file and print servers, Migration Manager uses Resource Updating Agents, which are installed either from Resource Updating Manager or using Group Policy or SMS, or manually on each computer to be updated. The Resource Updating Agents run as services. Resource Updating Manager uses its own service account to access computers and install or uninstall the Resource Updating Agents. This is called the Migration Manager RUM Controller service account. When using Resource Updating Manager, for every domain you can specify another account which will be used to set up the Resource Updating Agents to the computers of this domain and to run Resource Updating Agent service. Statistics Portal The Statistics Portal is an optional but extremely useful component for both Migration Manager for Exchange and Migration Manager for Active Directory. The Statistics Portal provides statistics and reports about the progress and status of your migration project. You connect to the portal that retrieves information from the ADAM project partition and from the SQL configuration database. Statistics Collection Agent The Statistics Collection Agent is an optional Migration Manager for Exchange component used to collect statistical data on Exchange data migration progress. Licensing Migration Manager for Active Directory The Migration Manager for Active Directory license specifies the maximum number of user accounts you can migrate and the maximum number of user accounts you can synchronize. Directory synchronization agents obtain license information from the migration project partition stored in Active Directory Application Mode (ADAM). Therefore, the agents must have access to the ADAM server and migration project partition. For more information, refer to the System Requirements and Access Rights document. Migration Manager for Exchange The Migration Manager for Exchange license specifies the maximum number of mailboxes that you can migrate. Because Migration Manager for Exchange uses a distributed architecture, its agents obtain all license information from a single license server. By default, a server on which the Migration Manager is installed is used as the license server. Later you can change the license server using the Migration Manager for Exchange Options. Note that the agents must have access to the license server. For more information, refer to the System Requirements and Access Rights document. 7

10 Quest Migration Manager 8.7 Before You Begin Preparation Checklist The following table lists the preparation tasks for the migration process and where to find detailed information about each. The Exchange preparation tasks in this checklist are mostly relevant to Exchange 2000 and Exchange 2003 organizations. For preparation checklist of Exchange 2007 and 2010 organizations, please refer to dedicated Exchange environment preparation documents. TASK DETAILS REFER TO Check the system requirements Prepare the source and target environments for Active Directory migration Prepare the source and target environment for Exchange migration Before installing Migration Manager, make sure that the following servers meet the system requirements: Source and target servers Console ADAM server Configuration database for Exchange migration Directory Synchronization Agent server Migration Manager Statistics server Any computer that does not meet the requirements should be upgraded before installing Migration Manager components. Establish trusts Disable SID filtering Check host name resolution Verify that the required ports are open on servers, routers, and firewalls Exchange 2000/2003: Implement Exchange backup strategy Create Aelita EMW Recycle Bin public folder Create additional mailboxes The System Requirements and Access Rights document The Preparing the Source and Target Environments for Active Directory Migration section of this guide The Preparing the Source and Target Environments for Exchange Migration section of this guide 8

11 Installation Guide TASK DETAILS REFER TO Connect the source and target Exchange Organizations using SMTP connectors Set the required permissions Exchange 2000/2003: Set up the SMTP connectors Force Exchange to accept the redirected mail as inbound mail Modify name resolution parameters on the bridgehead servers in Exchange Configure DNS for mail forwarding Test the SMTP connectors Set the required permissions for Migration Manager accounts Set the required permissions for Active Directory migration Set the required permissions for Exchange migration The Connecting the Source and Target Exchange Organizations Using the SMTP Connectors section of this guide The Migration Manager Operation Accounts section of the System Requirements and Access Rights document The following sections of the System Requirements and Access Rights document: Accounts and Rights Required for Active Directory Migration Tasks Appendix A: How to Set the Required Permissions for Active Directory Migration Dedicated Exchange 2007 and Exchange 2010 environment preparation documents and the following sections of the System Requirements and Access Rights document: Accounts and Rights Required for Exchange Migration Tasks Appendix B: How to Create Single Administrative Account for Exchange Migration Appendix C: How to Set the Required Permissions for Exchange Migration Make other preparations (if applicable) The Other Pre-Installation Considerations section of this guide 9

12 Quest Migration Manager 8.7 Pre-Requisites Before installing Migration Manager, make sure your environment meets the system requirements listed in the System Requirements and Access Rights document. In particular, check the requirements for the following computers: Migration Manager console Domain controllers (source and target) Source and target Exchange servers (for Migration Manager for Exchange) Migration Manager database servers Active Directory Application Mode server Migration Manager for Exchange database server Migration Manager agents servers Directory Synchronization Agent server Statistics Collection Agent server Statistics Portal server Migration Manager Components and Service Accounts As described above, Migration Manager consists of several components, including: Migration Manager console Directory Synchronization Agent Migration Manager for Exchange agents Statistics Collection Agent Statistics Portal To perform their tasks, these components use several accounts, called service accounts or administrative accounts. Access rights and permissions required for these accounts are described in the System Requirements and Access Rights document. 10

13 Providing for Resources Availability (Active Directory Migration) Installation Guide To ensure that resources will still be available to users when they start using their target accounts and when you have cleaned up SIDHistory, permissions granted to source accounts to access the resources must be reassigned to the target accounts. Service accounts and accounts used to run scheduled tasks must also be changed to the corresponding target accounts to ensure that services and scheduled tasks will run correctly after the source accounts are disabled. The resources can be divided into two groups: Distributed resources, such as end-user workstations, file and print servers, servers running IIS, scheduled tasks, and other services and applications BackOffice servers, such as Exchange, SQL, and SMS To make the migration transparent to users, Migration Manager for Active Directory uses a set of utilities that provide for automated resource processing to reflect the domain reconfiguration. Administrative Access to Distributed Resources Administrative rights over the resources are required for successful resource updating. To obtain administrative rights, do either of the following: Add the account you are currently logged on to the console to the local Administrators group on each computer to be updated. By default, the Domain Admins group of the domain that the computer is a member of is a member of a computer s local Administrators group. You will get administrative access to the computer if the account you are using to use to log on to the console is a member of the source Domain Admins group. Use another account that is a member of a computer s local Administrators group to connect to the computer. Establish the connection to the machine s administrative share using a standard net use command, as follows: net use \\MachineName\Admin$ /u:domainname\admin_account net use \\MachineName\C$ /u:domainname\admin_account where the Admin_Account is the account that is a member of a computer s local Administrators group. Server Service Server service is automatically installed when you install the File and Printer Sharing service on the computer. Server service must be running on a computer to be updated from either Resource Updating Manager or the command-line updating tool VMover.exe. If for some reason (for example, due to your corporate policy), Server service is not allowed to run on the computers, you need to install or enable Server service temporarily, update the computers, and then disable or uninstall the service. 11

14 Quest Migration Manager 8.7 Administrative Access to BackOffice Servers For information about the permissions required for successful Exchange, SMS, and SQL server update, please refer to Appendix A. How to Set the Required Permissions for Active Directory Migration of the System Requirements and Access Rights document. To learn how to set the required permissions for Microsoft BackOffice products, refer to their documentation. Other Pre-Installation Considerations This section describes environment peculiarities you may need to consider before deploying Migration Manager and starting your migration project. Active Directory Connector If you have already started Exchange migration with the Active Directory Connector (ADC), note that Migration Manager and ADC use different object matching criteria, so ADC should be completely replaced with Migration Manager directory synchronization in the inter-org migration scenario. Migration Manager and Microsoft Outlook Microsoft does not recommend installing Outlook on Exchange Server, because its security extension is low for the server side. For more information, please refer to Microsoft does not support installing Exchange Server components and Outlook on the same computer Microsoft Knowledge Base article. Cluster Support Migration Manager supports multi-node clusters running multiple Exchange Virtual Servers. Migration Manager detects such systems and configures agent services for automatic failover together with the Exchange services. However, if several Exchange Virtual Servers are running on a single cluster node, the agents can be installed and run only on one Exchange Virtual Server at a time. Thus, such Exchange servers can participate in migration with Migration Manager only consecutively, one by one. There are also some Exchange Virtual Server limitations on clusters that have more than two nodes. For more details, refer to Exchange virtual server limitations on Exchange 2000 clusters and Exchange 2003 clusters that have more than two nodes Microsoft Knowledge Base article. Migration Manager fully supports Exchange 2007 Cluster Continuous Replication (CCR). It detects such systems and configures agent services for automatic failover together with the Exchange services. For more information about supporting Exchange 2007 CCR cluster servers, refer to Appendix B of the Quest Migration Manager for Exchange User Guide. Standby Continuous Replication (SCR) and Local Continuous Replication (LCR) types are also supported, but in case of failover, a full resynchronization of all mailboxes, calendars, and public folders involved in the migration must be performed. 12

15 Installation Guide Migration Manager and Backup Utilities If any backup tools are installed on the servers where Migration Manager agents are to run, the schedule for these tools and the agents should not overlap; that is, the backup utility and the agents should be scheduled to work during different hours. In any case, the use of any backup utility together with Migration Manager should be tested in the lab before deployment in the production environment. Providing Communication Using IP version 4 for Exchange Migration TCP/IP version 4 (IPv4) must be installed and configured on all servers on which you are going to install Migration Manager for Exchange agents. 13

16 Quest Migration Manager 8.7 Preparing the Source and Target Environments for Active Directory Migration Step 1: Establish Trusts Trusts between the source and target domains are not required for Active Directory or Exchange migration with Migration Manager. However, we recommend that you establish two-way trusts between each source and target domain that will participate in migration. If the forest functional level in both source and target forests is set to Windows 2003 or higher, you can establish forest trust between the forest root domains. Trusts make it possible to resolve objects security identifiers (SIDs), which in turn helps to distinguish objects and check that everything is going right. Trusts also help provide co-existence of two environments, including uninterrupted access to the resources for both switched users and users not yet switched. For more information about the restrictions that apply and possible migration scenarios without having trusts established, refer to the Migration Manager Best Practices document. Step 2: Disable SID Filtering By default, SID filtering is turned on. You do not need to disable SID filtering if you have established a forest trust between source and target forest. SID filtering for each source domain to be migrated should be turned OFF in any of the following cases: If you have established external trusts between each source and target domain If source accounts were previously migrated and contain SIDs from other domains in their SID history To disable SID filtering, you must be a domain administrator. 14

17 Installation Guide For external trusts, use the Netdom.exe utility from Windows Server Support Tools with the following syntax: Netdom trust TrustingDomainName /domain:trusteddomainname /quarantine:no /usero:domainadministratoracct /passwordo:domainadminpwd To enable SID filtering, set the /quarantine: command-line option to Yes. For more information about external trusts, SID filtering, and the Netdom utility, refer to the Microsoft article available at Step 3: Check Host Name Resolution DNS Name Resolution Make sure that DNS is configured and functioning properly in your environment. The following computers' DNS names must be successfully resolved to IP addresses from the servers running the Directory Synchronization Agents and Migration Manager console: Source and target servers Server on which the ADAM project partition is located Server hosting the SQL configuration database NetBIOS Name Resolution Since the agents installed on the source and target Exchange servers communicate with each other, Exchange source-target server pairs must be able to resolve each other s NetBIOS names to IPv4 addresses. In other words, each server must be able to see the other servers by NetBIOS. Windows Internet Naming Service (WINS) is usually used to resolve servers NetBIOS names to IP addresses. If WINS is not configured in your environment, host files can be used instead. Check the host NetBIOS name resolution and make sure that the servers NetBIOS names can be resolved from the console as well. 15

18 Quest Migration Manager 8.7 Step 4: Open the Required Ports on Servers, Routers, and Firewalls Since the Migration Manager agents are installed and updated from the console over RPC and the agents transfer data directly between source and target servers over RPC as well, RPC traffic must be allowed over the routers separating the subnets. Make sure that ports 135, 137, 138, and 139 are open on the following machines: Source and target servers Routers separating the subnets Firewalls Step 5: Configure Windows Server 2008 Firewall Windows Server 2008 has built-in firewall that is enabled by default. To migrate passwords and SIDHistory, you need to modify the firewall settings on a target domain controller and create a new inbound rule. This is also required for proper operation of the Undo Wizard and for SIDHistory Cleanup using the Active Directory Processing Wizard. To create a new rule on an x86 target domain controller, run the following command: netsh advfirewall firewall add rule name="quest Migration Manager Agent" dir=in action=allow program="%systemroot%\system32\aelagentms.exe" To create a new rule on an x64 target domain controller, run the following command: netsh advfirewall firewall add rule name="quest Migration Manager Agent" dir=in action=allow program="%systemroot%\system32\aelagentms64.exe" Alternatively, you can create a new rule using the New Inbound Rule Wizard. To run the wizard: 1. Open the Server Manager console on a target domain controller. 2. Navigate to Configuration Windows Firewall with Advanced security Inbound Rules in the console tree. 3. Click New Rule In case of two-way directory synchronization, you should perform the same actions on the source domain controller. 16

19 Installation Guide Preparing the Source and Target Environment for Exchange Migration This section describes general steps you must take to prepare for Exchange migration. It deals only with Exchange 2000 and 2003 environments. For information about later Exchange versions, see the corresponding documents: Source Exchange 2007 Environment Preparation Target Exchange 2007 Environment Preparation Source Exchange 2010 Environment Preparation Target Exchange 2010 Environment Preparation Step 1: Back up Exchange Before implementing Migration Manager in your production environment, back up your Exchange infrastructure. We recommend that Active Directory data be backed up at least twice a day during migration. Transaction Log File Cleanup When Migration Manager for Exchange synchronizes mail and public folders, for every megabyte of data migrated from the source to the target, a transaction log file of equal size is generated on the target Exchange server. Exchange-aware backup applications purge the transaction logs after the backup completes. By the time the backup finishes, all logged transactions have already been applied to the store and backed up to tape, making log cleaning safe. Large transaction logs that are generated during mailbox migration quickly occupy free disk space. To work around this problem, perform one of the following: If a full backup strategy is implemented in the organization or there is no backup strategy at all, then circular logging may be enabled for unattended log deletion. If an incremental or differential backup strategy is already implemented in the organization, then make sure that logs are cleared automatically. Do not enable circular logging in this case. 17

20 Quest Migration Manager 8.7 Note also that Microsoft recommends turning OFF circular logging on the Exchange server. For more information, refer to Microsoft Knowledge Base article , XDAM: How Circular Logging Affects the Use of Transaction Logs. Step 2: Create Aelita EMW Recycle Bin Public Folder If you plan to perform public folder synchronization using Migration Manager Public Folder Agents, you should create a special public folder called Aelita EMW Recycle Bin. Replicate this folder to all the public folder servers involved in the public folder synchronization process. This folder will help prevent data loss in case of accidental public folder deletion or incorrect moves. When a public folder is deleted in one of the environments, the public folder synchronization agents move the corresponding folder in the other environment to the Aelita EMW Recycle Bin folder, if one exists, instead of permanently deleting the folder. You can use this folder to check whether important information has been deleted, and restore any data deleted by mistake. Step 3: Create Mailboxes for Public Folder and Free/Busy Synchronization Administrative mailboxes should be created on all Exchange servers involved in public folder and free/busy synchronization. These mailboxes will be used to access the public folder tree and the Schedule+ Free/Busy folder when creating public folder and free/busy synchronization jobs. The account under which the public folder synchronization agents and the free/busy synchronization agents process Exchange data migration should have full access to the administrative mailbox specified for the appropriate server so that the agents can get administrative access to the synchronized folders. See the System Requirements and Access Rights document for details. The administrative mailbox selected for public folder synchronization should be hosted on the same server as the public database. This public database should be associated with the mailbox database where the administrative mailbox resides. The setting can be verified in the properties of the mailbox database. The administrative mailbox specified for the synchronization job should not be changed during the synchronization process. The administrative mailboxes should not be included in mailbox or calendar synchronization jobs. 18

21 Installation Guide Connecting the Source and Target Exchange Organizations Using SMTP Connectors To ensure that users do not lose their mail during the migration period, and to make the migration from source Exchange organization to target smooth, Migration Manager establishes mail redirection between the source and the target Exchange servers. Accordingly, Migration Manager requires the source and target Exchange organizations be connected using SMTP connectors. This section deals only with Exchange 2000 and 2003 environments. For information about later Exchange versions, see the corresponding documents: Source Exchange 2007 Environment Preparation Target Exchange 2007 Environment Preparation Source Exchange 2010 Environment Preparation Target Exchange 2010 Environment Preparation 19

22 Quest Migration Manager 8.7 Step 1: Set Up the SMTP Connectors Create SMTP connectors between the bridgehead servers of your source and target Exchange organizations by taking the following steps: 1. In Exchange System Manager, right-click the Connectors node, select New, and then select SMTP Connector. The following is an example of connector configuration for a source Exchange 2003 server. 2. Go to the General tab of the new connector s properties, and click Add to specify the name for the connector and local bridgehead server. Select the Use DNS to route to each address space on this connector option to use DNS to route mail to the address spaces specified for this connector. 20

23 Installation Guide 3. When Migration Manager for Exchange is configured to use SMTP for mail redirection, mail is forwarded to additional SMTP addresses generated by the Directory Synchronization Agent and based on the address templates you provide when setting up the directory synchronization jobs. Go to the Address Space tab and click Add to add a new address space. It is recommended that you use the same SMTP prefix that was specified in the Target SMTP address template in the directory synchronization settings. 4. Configure other options if needed and click OK. This example shows the other options keeping their default values. Step 2: Force Exchange to Accept Redirected Mail as Inbound Mail Migration Manager for Exchange provides for uninterrupted user collaboration using the technology of mail redirection between the source and target organizations. Additional SMTP addresses are used for mail redirection. These addresses are automatically added by the Directory Synchronization Agent. For mail redirection to work, the mail destined to the additional addresses must be accepted as inbound mail. For that, create a recipient policy to make the Exchange organization responsible for all mail delivery to the specified addresses. 21

24 Quest Migration Manager 8.7 Creating a Recipient Policy To make Exchange consider the redirected mail to be inbound mail and search for the recipients in Active Directory, configure your recipient policy as follows: 1. In Exchange System Manager, expand Recipients in the left-hand pane tree, and then right-click the Recipient Policies node and create a new policy. 2. In the New Policy dialog box that opens, make sure only the Addresses option is selected. 3. Provide a name for the new policy and leave the list of filter rules blank. 4. On the Addresses (Policy) tab, remove all of the listed address entries. 5. Add a new SMTP entry. In the Address field, type the address space that you plan to specify for the source or target Exchange organization when setting up the directory synchronization job (for respectively). 6. Verify that the This Exchange Organization is responsible for all mail delivery to this address check box is selected. Then click OK. Step 3: Modify Name Resolution Parameters on the Bridgehead Servers in Exchange To provide for zero-impact migration, recipients of the redirected mail must be resolved to the corresponding directory objects whose addresses are contained in the Global Address List (GAL). To make Exchange resolve SMTP addresses into the directory objects, modify the name resolution parameters on the bridgehead servers in the Exchange organization. Exchange 2000 Exchange 2000 resolves recipients of all incoming mail automatically. For more details, refer to Microsoft Knowledge Base article available at Exchange 2003 Turn on the Resolve Anonymous option on each Exchange 2003 bridgehead server, as follows: 1. In Exchange 2003 System Manager, expand Servers node, and then expand the target server's node. 2. Expand the Protocols node, and then expand the SMTP node. 3. Right-click the SMTP virtual server and then click Properties. 4. In the Properties dialog box, go to the Access tab. Click Authentication, and then select the Resolve anonymous check box. 5. Repeat this procedure for each Exchange 2003 bridgehead server. For more details, refer to the Resolve Anonymous Senders Functionality in Microsoft Exchange 2003 Microsoft Knowledge Base article. 22

25 Installation Guide Step 4: Configure DNS After you have configured the SMTP connection between the source and target Exchange organizations, you should also add the MX (Mail Exchanger) records for the source and target domains to the DNS. This is necessary to forward the mail (redirected to the additional SMTP addresses added by the Directory Synchronization Agent) to the source and target SMTP bridgeheads. Alternatively, instead of creating MX records in DNS, you can configure SMTP connectors to redirect mail to the source and target SMTP bridgeheads correspondingly. As an example, we will use the following additional address to redirect mail from target to source mailboxes. A secondary SMTP address will be added to each source mailbox by the Directory Synchronization Agent according to this to redirect mail from source to target mailboxes. A secondary SMTP address will be added to each target mailbox by the Directory Synchronization Agent according to this template. To set Mail Exchanger (MX) record for the source domain: 1. In the DNS snap-in, connect to the source DNS server and browse to the Forward Lookup Zones container. 2. Right-click the Forward Lookup Zones and select New Zone 3. In the New Zone wizard, select the Primary zone to be created. 4. Type local for the Zone name and complete the wizard. 5. Right-click the newly-created zone object local, and click New Mail Exchanger on the shortcut menu. 6. In the New Resource Record dialog, type source for the Host or child domain. 7. Click Browse and select the Exchange server in the source domain to which mail sent to domain will be redirected. 8. Click OK. To set the Mail Exchanger (MX) record for the target domain: 1. In the DNS snap-in, connect to the target DNS server and browse to the Forward Lookup Zones container. 2. Right-click the Forward Lookup Zones and select New Zone 3. In the New Zone wizard, select the Primary zone to be created. 4. Type local for the Zone name and complete the wizard. 5. Right-click the newly-created zone object local, and click New Mail Exchanger on the shortcut menu. 6. In the New Resource Record dialog, type target for the Host or child domain. 23

26 Quest Migration Manager Click Browse and select the Exchange server in the target domain to which mail sent to domain will be redirected. 8. Click OK. Step 5: Test the SMTP Connectors To test the SMTP connectors: 1. Create test mailboxes on the source and target Exchange servers. In this example, both mailboxes will be called mbx1. 2. Both mailboxes should have the same primary SMTP address. In this example the primary address for both mailboxes will be Additional addresses will be for the source mailbox, and for the target mailbox. 3. Create a contact on the source Exchange server and point it to the additional SMTP address of the target Exchange mailbox. 4. Create a contact on the target Exchange server and point it to the additional SMTP address of the source mailbox. 24

27 Installation Guide 5. Open the test source mailbox and send an to the source contact. 6. Open the test target mailbox and make sure that the has arrived. 7. From the test target mailbox, send an to the contact, and make sure the has reached the source test mailbox. 25

28 Quest Migration Manager 8.7 Installing Migration Manager Migration Manager Setup To install Migration Manager, either click Install Quest Migration Manager and its components on the CD menu or start the Suite\AeCDSuiteLauncher.exe setup program, and then follow the wizard s instructions. To install Migration Manager: 1. When prompted, specify your name and company. Click Licenses to verify your license information in the dialog displayed: browse for a valid license file, and then click Close. 2. Next, on the Select Features step, select the components you want to install and specify the installation folder. 3. On the next step, you are prompted to select the product installation scenario. Possible options are Express or Advanced. Express means that setup will do the following: Install all the components that are permitted by the license file. Install all other required components, such as the ADAM instance, SQL Server or SQL Server Express instance (for Exchange migrations only), and the Directory Synchronization Agent. 26

29 Installation Guide Configure the project. If IIS is installed on the computer, Statistics Portal will be automatically installed and configured as well. Advanced is recommended if you plan to manually install ADAM, SQL Server or SQL Server Express (for Exchange migrations only), and the Directory Synchronization Agent, as well as configure the project by running the Open Project Wizard (described later in the Opening a Migration Project section of this document). Only the basic product components (selected in Select Features step) will be installed automatically. When selecting the setup scenario, consider the following: By default, SQL Server Express is installed with only Windows (AD-integrated) authentication allowed; however, Statistics Portal required basic SQL authentication. To provide for SQL authentication method, you can do either of the following: Use the Express setup scenario (proper configuration will be applied automatically). After running the Advanced setup, install SQL Server Express using the special installation wizard from Migration Manager CD Autorun, and then use the Microsoft SQL Server Management tools (Enterprise Manager), or edit the registry as described in Microsoft Knowledge Base article at If you select the Advanced setup scenario, you will be taken to step 7 of this procedure. 4. On the Set Account for ADAM Access step, specify the auxiliary account that various Migration Manager components will use to access the ADAM database. As described in the Accounts and Access Rights section above, this account does not require any particular rights in the domain; ordinary domain user rights are sufficient. However, this account must be a member of the computer local Administrators group on the computer running the Migration Manager console. Note that this account will be granted Full Admin rights in the project database. 5. On the MSDE setup step, specify the password for the sa account that will be used to install and configure the local SQL Server database. 6. Next, the setup checks for third-party software required for Migration Manager (for example, Microsoft Message Queuing). If some required components are missing, setup will notify you and attempt to install these components from the installation CD. To install these components automatically, click Next; alternatively, you can install them manually and click Retry to let the setup recheck the missing software list. 7. After all the required components are installed, the setup wizard is ready to install the features you have selected (and configure the product if the Express setup scenario is running). Click Next and wait for the installation to complete. 27

30 Quest Migration Manager 8.7 Downloading MAPI CDO Migration Manager also requires version or later of Microsoft Exchange Server MAPI Client and Collaboration Data Objects to be installed on the following computers: Where Migration Manager agents will run (that is, Exchange 2007 and 2010 Servers and agent hosts) Where the Migration Manager console is installed The MAPI CDO setup package is not available for distribution; for details about obtaining it, please see Microsoft Knowledge Base article This package cannot be installed on a system on which any version of Microsoft Outlook or Microsoft Exchange Server 2003 or earlier is installed. 28

31 Installation Guide Getting Started Opening a Migration Project In most cases you will need just one Migration Manager project for your whole migration, no matter how many domains you have. Normally, you would use a separate project only for lab testing before you start migration in the production environment. The Open Project Wizard will help you with configuring the migration project and all its components: the ADAM database, the SQL Server database (for Exchange migrations only), and Statistics Portal. These configuration steps are required if you installed Migration Manager using Advanced mode. If you used Express setup mode, ADAM was installed and configured automatically. The wizard can be used to start a new project, connect to an existing project, or change any settings of the current project. When you run Migration Manager for the very first time, the Open Project Wizard is installed and started automatically. To start the Open Project Wizard for subsequent uses, in Migration Manager console, select File Open Project. The following steps are presented in the Open Project Wizard to help you configure your migration project. Step 1: Configure ADAM Database If you installed Migration Manager using Advanced mode, you need to install and configure Microsoft Active Directory Application Mode (ADAM) manually. ADAM can be found on the Migration Manager CD and on Microsoft s Web site If Express setup mode was used, ADAM was installed and configured automatically. Migration Manager uses Microsoft Active Directory Application Mode (ADAM) to store its project data. 29

32 Quest Migration Manager 8.7 On the Select Project>Configure ADAM Project page of the wizard, configure the following settings: ADAM server Specify the name of the server on which ADAM is installed. Migration Manager will try to connect to the server by LDAP and locate the ADAM instance. Port The port number of the ADAM instance. By default, ADAM uses port 389. The port number might be different if ADAM is installed on a domain controller or this is not the first ADAM instance on the server. Select a project For each new project, Migration Manager automatically creates a partition in the ADAM instance you specify. You can either connect to the existing project or create a new one: To create a new project, select the Create a new project option and type a name for the project. Migration Manager will create an ADAM partition for the new project and, if required, extend the ADAM schema. To connect to an existing project, select the Use existing project option. If the ADAM database already has Migration Manager projects in it, select the necessary project from the Use existing project dropdown list. Alternatively, click the Retrieve Projects button. Migration Manager will connect to the ADAM and retrieve the list of its projects already in the database. 30

33 Installation Guide Step 2: Set Auxiliary Account The ADAM database is the central configuration storage for the migration project. On this step of the wizard, you can specify the auxiliary account that various Migration Manager components will use to access the ADAM database. Username Specify the username for ADAM access. This can be any account that can be successfully resolved on the console, ADAM server, computers from which the resource updating will be performed, and other computers on which Migration Manager components will run. Password Type the password for the account. This account must be a member of the computer local Administrators group on the computer running the Migration Manager console. No particular rights in the domain are required; ordinary domain user rights are sufficient. Consider that the account will be granted Full Admin rights in the project database. 31