Granting Full Control on the Microsoft Exchange System Objects Organizational Unit
The Source Exchange Account used by Migration Manager for Exchange agents needs the Full Control permission on the Microsoft Exchange System Objects organizational unit (OU) in all domains in which source Exchange servers involved in public folder synchronization reside.
- In the Active Directory Users and Computers snap-in, right-click the Microsoft Exchange System Objects OU and click Properties.
NOTE: If there is no Microsoft Exchange System Objects OU, you should select View | Advanced Features in the Active Directory Users and Computers snap-in.
- On the Security tab, click Add, and select the Source Exchange Account (in our example, QMM_Src_Ex).
- Select the account name, and then enable the Allow option for the Full Control permission in the Permissions box.
- Click the Advanced button. In the Advanced Security Settings dialog box, select the account you specified on step 2, and click Edit.
- In the Permission Entry dialog box, select This object and all child (descendant) objects from the Apply onto drop-down list.
-
Close the dialog boxes by clicking OK.
Granting the Exchange Public Folder Administrator Role
The Source Exchange Account requires the Exchange Public Folder Administrator role.
To grant it, complete the following steps:
- Launch the Exchange Management Console.
- Click the Organization Configuration node. Exchange Administrators tab will appear in the right pane.
- Right-click anywhere in the Exchange Administrators tab and select Add Exchange Administrator from the shortcut menu.
- In the Add Exchange Administrator dialog box click Browse, select the Source Exchange Account (in our example, QMM_Src_Ex) and click OK.
- Select the Exchange Public Folder Administrator role option and click Add.
-
Click Finish to exit the wizard and apply your changes.
|
|
Caution: If the Source Exchange Account is located in another trusted forest, you cannot assign the Exchange Public Folder Administrator role to this account. In this case grant the following permissions for the Exchange Administrative Group (FYDIBOHF23SPDLT) container and its child objects to the account in the Configuration partition using the ADSIEdit snap-in:
|
Setting Up the Source Active Directory Account
This section describes how to set the required permissions for the Source Active Directory Account used by Migration Manager for Exchange agents. This account is used for the following:
- Working with the source Active Directory
The required permissions for the Source Active Directory Account are as follows:
- Read access to the source domain
- Read permission for the Microsoft Exchange container in the source Active Directory
To set up the Source Active Directory Account, perform the steps described in the related subtopics.
|
|
NOTE: Note that these steps are given only as an example of a possible Source Active Directory Account setup. |
Changing the Default Source/Target Active Directory Account
Changing Default Active Directory Account
|
|
Caution: This section is relevant to the public folder synchronization only. Active Directory Account for mailbox or calendar synchronization is specified during corresponding job configuration. |
The default Source or Target Active Directory Account (initially displayed on the Associated domain controller page of the Exchange server's properties) is set when you add the source or target organization to the migration project (see the Registering Source and Target Organizations section of the Migration Manager for Exchange User Guide for details).
To change the Source or Target Active Directory Account, click Modify on the General | Associated domain controller page of the corresponding source (target) server properties in the Migration Manager for Exchange Console.
To go on using the default Source (Target) Active Directory Account for Exchange migration, grant the permissions required for Exchange migration to this account (see the next steps).