Migrating from Legacy Exchange

This chapter is from the book

Learning Exchange Server 2003

Learn More Buy

This chapter is from the book

This chapter is from the book 

Learning Exchange Server 2003

Learn More Buy

Forest and Domain Preparation

The first major stage of the deployment involves modifying the Active Directory schema and creating the top-level containers in the Configuration naming context. This is done as part of installing the ADC. Figure 12.14 shows the Exchange organization objects following the installation of the ADC and before installing the first Exchange server.

Figure 12.14 The ADC will create Organization placeholders but does not populate servers or connections until the first Exchange 2003 server is installed.legacy Exchange serversmigration to Exchange 2003pre-ADC installationmigration from legacy ExchangeADCpre-installation preparationsADC (Active Directory Connector)migration from legacy Exchangepre-installation preparationsinstallingADCForestprep stepsinstallingADCDomainPrep stepsForestprep step, ADC installationDomainprep step, ADC installation

This method for preparing the organization avoids the necessity for running ADC Setup with an account that has both full administrator rights in the legacy Exchange organization and Enterprise Admin permissions in the Active Directory forest. Many enterprises do not permit combining these two functions into a single administrator. This issue is independent of installing the ADC, and becomes a factor only because the ADC requires Forestprep and Domainprep.

ADC Setup Permissions

The account you use to install the first ADC must meet the following requirements:

• Belong to the Enterprise Admins group. This allows Setup to modify the Configuration naming context.

• Belong to the Schema Admins group. This allows Setup to modify the schema.

• Belong to the Domain Admins group in the domain where the ADC resides. This allows Setup to create the Exchange Services group in the domain and to write to the Registry of the server hosting the ADC service.

Installing subsequent ADCs requires Domain Admin rights only in the domain that hosts the server.

Because ADC Setup performs all the necessary schema modifications for Exchange 2003, installing the first Exchange 2003 server after installing the ADC requires Domain Admin permissions only in the domain hosting the server along with Exchange Full Administrator permissions in the Exchange organization.

Subsequent Exchange 2003 server installations requires Exchange Full Administrator permissions only in the Administrative Group (legacy site) containing the server.

ADC Server Selection

The Exchange 2003 ADC service can run on Windows 2000 SP3+, Windows Server 2003 Standard, or Enterprise Edition as long as the server belongs to the same forest as the Exchange 2003 organization. The service communicates with Active Directory, but it does not need to run on a domain controller.

If you have a large organization with many Exchange sites, you should dedicate a server exclusively to running the ADC so that it can handle connections to the various sites without interruption. If you have a medium-sized organization with a few sites, you can run the ADC service on a domain controller or directly on the Exchange 2003 server.

If possible, install the ADC server in the forest root domain where administrators have full rights to the Configuration naming context and the schema.

If you cannot install the ADC server in the forest root domain, before you install the ADC, extend the schema in the forest root domain using setup /schemaonly while logged on as an Enterprise Admin and a member of Schema Admin group. This step is not included in the Exchange 2003 prescriptive checklist.

ADC Service Account Selection

During ADC Setup, you must designate a service account for the ADC that it can use when connecting to a legacy Exchange server. The service account you designate during Setup becomes the Logon Account for the service, as shown in Figure 12.15.

Figure 12.15 ADC requires a service account with access to legacy Exchange directory service.migration from legacy ExchangeADCservice account selectionADC (Active Directory Connector)migration from legacy Exchangeservice account selectioninstallingADCservice account selection

You should not use the domain Administrator account for the ADC service account. It's too likely that you'll forget you did this and change the password. Also, most security experts agree that the domain Administrator account should be avoided as a service account to minimize the impact of a successful penetration. Instead, use the following criteria to select the service account:

• If the ADC server belongs to the same domain as the legacy Exchange servers (for example, after performing an in-place upgrade), then you can use the same service account as that used by the legacy Exchange servers. (And if that's the domain Administrator account, well, shame on you.)

• If the ADC resides in a different domain than the legacy Exchange servers, create a new account in Active Directory and grant this account Service Account Admin permissions on the Organization, Site, and Configuration containers in each legacy Exchange site.

On the Active Directory side, ADC Setup creates a group called Exchange Services with Full Control access rights to the Exchange organization. It makes the ADC service account a member of this group.

Domain Prerequisites

Windows 2000 introduced the concept of a "mode change" to differentiate between a domain that can support NT BDCs (Mixed mode) and one that has full functionality (Native mode). Windows Server 2003 extends the mode concept to include backward compatibility with Windows 2000 but the term is now "functionality level." The highest functional level is Windows Server 2003. This functional level enables certain critical features helpful for Exchange 2003 operation, such as replicating individual members of groups and reducing the replication interval within a site from five minutes to five seconds.

Exchange 2003 does not require a functional level of Windows Server 2003, but it does require at least one domain to be set at the functional level of Windows 2000 Compatible. This enables Universal Security Groups.

If you are consolidating multiple NT4 domains into a single Active Directory domain, you must have a trust between each NT4 domain, the Active Directory forest root domain, and each domain hosting users with mailboxes on NT4 Exchange servers.

You'll also need to perform a few operations in each domain that hosts mail-enabled objects:

• Name Resolution. Verify proper DNS name resolution at each server you intend to use for ADC and Exchange 2003. It's important that the servers find domain controller and Global Catalog servers. You should also verify proper WINS registration for Exchange server candidates. Legacy Exchange servers and downlevel Exchange clients use WINS to locate Exchange services. WINS has a couple of other minor functions, as well. See hellomate.typepad.com/exchange/2004/03/exchange_200x_r.html for details.

• ADC Staging OU. You'll need an OU to act as a repository for groups and contacts created by the ADC when it replicates distribution lists and custom recipients along with disabled user accounts representing resource mailboxes. In the examples, I'll call this OU the ADC_Staging_Area.

• Verify Trusts. The trust relationships between the Active Directory domains and any downlevel domains must be intact. Use Nltest from the Windows Server 2003 Support Tools to verify the trust.

• Global Catalog locations. You should have at least one Global Catalog server in each site that has an Exchange 2003 server. Microsoft recommends a 4-to-1 ratio for the number of processors in your Exchange servers to the number of Global Catalog servers. For example, if you have two 4-way Exchange servers in the same site, you should have two Global Catalog servers. If you have a single domain, enable the Global Catalog on all domain controllers. This does not increase the size of the Active Directory file. It merely ensures that the server listens on TCP port 3268 for LDAP queries directed at the Global Catalog.

• Active Directory Replication topology. Identify each Active Directory bridgehead server and map out the inter-site replication links. This helps you diagnose replication problems that might occur when you upgrade the Schema. Also, Exchange 2003 depends on Active Directory replication to inform other Exchange servers about configuration changes, so you want to document your configuration and get proactive about monitoring for critical events.

• Remove Internet Explorer Enhanced Security. ADC Setup (and Exchange 2003 Setup) make extensive use of Internet files (.html, .hta, and so forth). This can cause you a bit of irritation because Windows Server 2003 has a feature called Internet Explorer Enhanced Security that forces to you accept the location for each of the screens launched by the wizard. Do yourself a favor and remove this feature from the server, at least for the duration of the ADC and Exchange setup.

To remove the Internet Explorer Enhance Security feature:

1. Launch Control Panel.

2. Open the Add/Remove Programs applet.

3. Click Add/Remove Windows Components.

4. Uncheck the Internet Explorer Enhanced Security Configuration option, shown in Figure 12.16.

   Figure 12.16 Simplify ADC and Exchange Setup by removing Internet Explorer Enhanced Security Configuration for the duration of the Internet Explorer Enhanced Security Configuration service installation.legacy Exchange serversmigration to Exchange 2003pre-ADC installation

5. Click Next to accept the change.

When you've finished installing the ADC and/or Exchange on the server, feel free to install the Internet Explorer Enhanced Security Configuration service again. It does not interfere with Exchange operations, and it prevents other administrators from using your Exchange server to browse the Internet and possibly download something that performs an unfortunate activity on your server.