Migration Manager for Exchange 8.15 - Source Exchange 2010 Environment Preparation

Granting Permission to Make Public Folders Mail-Enabled

If a public folder is mail-enabled in the target organization, the Public Folder Source Agent needs to be able to make it mail-enabled in the source organization as well. To achieve this, assign your Source Exchange Account permissions to run the Enable-MailPublicFolder cmdlet, as follows:

1. Add this account to the Public Folder Management group in the source Exchange 2010 organization:
   1. In the Active Directory Users and Computers snap-in select the Microsoft Exchange Security Groups node.
   2. In the right pane, right-click Public Folder Management group and click Properties .
   3. On the Members tab click Add and select the Source Exchange Account (in our example, QMM_Src_Ex).
   4. Close the dialog boxes by clicking OK.

   Caution: If the Source Exchange Account is located in another trusted forest, you cannot add the account to the Public Folder Management group. In this case grant the following permissions for the Exchange Administrative Group (FYDIBOHF23SPDLT) container and its child objects to the account in the Configuration partition using the ADSIEdit snap-in: Modify public folder replica list permission Modify public folder deleted item retention permission Modify public folder quotas permission

2. Give the account the Full Control permission on the CN=<ExchangeOrganizationName>,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<...>,DC=<...> container:
   1. From the Start menu, select Run. In the Run dialog box, type ADSIEdit.msc. Click OK.
      

      NOTE: If you have a Windows 2003 domain controller, the ADSIEdit utility, which is part of the Windows 2003 Support Tools, may not be installed. In this case install the Support Tools by running the Support\Tools\Suptools.msi file located on the Windows 2003 CD.

   2. In the ADSIEdit snap-in, open the CN=<ExchangeOrganizationName>,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<...>,DC=<...> container
   3. Right-click the CN=<ExchangeOrganizationName> container and click Properties.
   4. In the Properties dialog box, click the Security tab.
   5. On the Security tab, click Advanced.
   6. In the Advanced Security Settings dialog box, click Add.
   7. In the Select User, Computer, or Group (or similar) dialog box, select the Source Exchange Account (in our example, QMM_Src_Ex) and click OK.
   8. In the Permission Entry for dialog box, select This object and all child (descendant) objects from the Apply onto drop-down list.
   9. Allow Full Control permission for the Source Exchange Account.
   10. Close the dialog boxes by clicking OK.

Granting Full Control on Exchange 2010 Mailboxes

The Source Exchange Account used by Migration Manager for Exchange agents needs the Full Control permission on each mailbox database involved in migration and on its associated public folder database if it exists.

To grant the required permissions to the <User> (in our example, sourcedomain\QMM_Src_Ex), run the following two cmdlets in Exchange Management Shell:

Get-MailboxDatabase | Add-ADPermission -User <User> -AccessRights GenericAll -ExtendedRights Receive-As

Get-PublicFolderDatabase | Add-ADPermission -User <User> -AccessRights GenericAll -ExtendedRights Receive-As

To verify that all permissions for the Source Exchange Account are set correctly, select any mailbox involved in the migration in the Migration Manager Console and check that the Source Exchange Account has Full Access permission for the mailbox.

Granting Membership in Recipient Management Group

To perform Move mailbox operations, the Source Exchange Account needs to be assigned permissions to run the following cmdlets:

• New-MoveRequest
• Get-MoveRequest
• Remove-MoveRequest
• Get-MoveRequestStatistics

To grant these permissions, add the account to the Recipient Management group in the source Exchange 2010 organization, as follows:

1. In the Active Directory Users and Computers snap-in select the Microsoft Exchange Security Groups node.
2. In the right pane, right-click Recipient Management group and select Properties from the shortcut menu.
3. On the Members tab click Add and select the Source Exchange Account (in our example, QMM_Src_Ex).

   

4. Close the dialog boxes by clicking OK.

Granting Application Impersonation Role

Granting ApplicationImpersonation Management Role

To grant the ApplicationImpersonation management role to the <User> (in our example, LA\JohnSmith), run the following cmdlet in Exchange Management Shell:

New-ManagementRoleAssignment -Role ApplicationImpersonation -User LA\JohnSmith