Avatier Identity Management Suite Integrating Exchange 2010 With Identity Enforcer Version 9 2603 Camino Ramon Suite 110 San Ramon, CA 94583 Phone: 800-609-8610 925-217-5170 FAX: 925-217-0853 Email: support@avatier.com Page 1
Table of Contents 1 OVERVIEW... 3 2 PREREQUISITES... 4 3 GRANTING RECIPIENT MANAGEMENT EXCHANGE RBAC ROLE TO THE AIMS SERVICE ACCOUNT... 5 3.1 USING THE EXCHANGE MANAGEMENT CONSOLE TO GRANT RECIPIENT MANAGEMENT ROLE TO THE AIMS SERVICE ACCOUNT... 5 4 SETTING THE REMOTE EXECUTION POLICY ON THE AIMS SERVER... 8 5 CONFIGURING THE EXCHANGE CONNECTION SETTINGS IN IDENTITY ENFORCER... 9 6 ARCHIVING EXCHANGE 2010 SETUP... 10 Page 2
1 Overview Avatier's Identity Management Suite Identity Enforcer module can be integrated with Microsoft Exchange 2010 and provide mailbox provisioning and at the time of user account creation, and the management of Exchange 2010 mailbox properties when managing a user through the Identity Enforcer client. On user termination, AIMS can create a.pst archive of the contents of the user's Exchange mailbox, and move the the.pst file anywhere on your network for safe keeping. Page 3
2 Prerequisites The following prerequisites are required for integrating the Avatier Identity Management Suite's Identity Enforce module with Exchange 2010: 1. AIMS 9.0 must be installed and licensed. 2. Power Shell 2.0 must be installed on the AIMS server. 3. The Exchange Client Access Server must be running Exchange 2010 SP1 with Post SP1 Rollup 5 or higher. 4. A Windows AD account must be granted the "Recipient Management" Exchange 2010 RBAC role. This can be the AIMS Service account, or any other Active Directory account. 5. The name of the Exchange 2010 server that hold the Client Access Server role in the Exchange organization must be known. 6. AIMS is properly configured to provide the Exchange 2010 connection information to the Client Access Server from step 4. 7. The Active Directory resource containers in AIMS are configured to allow Exchange 2010 integration. 8. The Remote Script Execution policy on the AIMS server is set to allow remote signed scripts to execute. Page 4
3 Granting Recipient Management Exchange RBAC Role to the AIMS Service Account Granting of the proper permissions to create, manage and archive Exchange 2010 mailboxes through Identity Enforcer can be done via the Exchange 2010 Management Console. 3.1 Using the Exchange Management Console To Grant Recipient Management Role to the AIMS Service Account 1. Launch the Exchange Management Console, and select the Toolbox from the tree, then double-click on the Role Based Access Control (RBAC) User Editor link. Page 5
2. Outlook Web Access will launch. Logon to the OWA as an Exchange 2010 Administrator. 3. Double Click the "Recipient Management" Link in the center column. Page 6
4. Scroll the bottom of the display and click the "Add" button in the Members section 5. Search for the account you wish to grant the Recipient Management Role to, then click the "Add" button at the bottom of the screen. Once the account is added to the box, click the "Ok" Button. 6. Click the "Save" Button on the Recipient Management screen. 7. Close your OWA session, then exit the Exchange Management Console. Page 7
4 Setting the Remote Execution Policy on the AIMS Server In order to allow the AIMS server to perform remote PowerShell script execution, the execution policy of the AIMS server needs to be altered from the default setting of not allowed. 1. Log on to the AIMS server as a domain administrator. 2. Launch the Power Shell interface (Start / Programs / Administrative Tools / PowerShell Modules). 3. In the PowerShell interface, type the following command: set-executionpolicy - remotesigned 4. Exit the Windows PowerShell interface. Page 8
5 Configuring the Exchange Connection Settings in Identity Enforcer To configure Identity Enforcer to perform Exchange 2010 functions, you must provide the connection information for the account that was granted the Recipient Management RBAC role, and connect to the server that holds the Exchange Client Access Server role for the Exchange 2010 Organization. 1. Logon to the AIMS Configuration user interface 2. Navigate to AIMS / Security 3. Scroll to the bottom of the AIMS / Security page to the Exchange 2010 Integration section. 4. Enter the name of the Exchange server that holds the Client Access Server role in the Exchange Organization. 5. Specify the user account that was granted the Recipient Management Exchange RBAC permissions. 6. Enter the password for the account that was granted the Recipient Management Exchange RBAC permissions. 7. Click the "Test" Button. 8. If the test was successful, click the "Save" button at the top of the screen. Page 9
6 Archiving Exchange 2010 Setup AIMS can create a PST archive for an account that is being disabled or deleted. In order to create the PST file, the Exchange server that holds the Client Access Server role in the Exchange Organization must be at Exchange 2010 SP1 with post SP1 rollup 5 or higher. The post SP1 rollup 5 patch added a PowerShell cmdlet that is needed to successfully create the archive file. If your Exchange servers are at the correct version level, you must create a special Exchange Management role assignment for the account specified in the AIMS Exchange 2010 connection configuration in section 5 of this document. 1. Logon to any Exchange server in the Exchange Organization as an Exchange Administrator. 2. Launch the Exchange Management Shell. 3. In the Exchange Management Shell interface type the following command: New-ManagementRoleAssignment Role Mailbox Import Export User yourdomain\useraccount Where: yourdomain\ = the NetBIOS name of the domain of the account used for the Identity Enforcer Exchange 2010 connection. UserAccount = the account specified for the Identity Enforcer Exchange 2010 connection. 4. Close the Exchange 2010 Management Shell. Page 10