Migration Manager for AD 8.15 - Granular Account Permissions

Using Preinstalled Service Feature

The preinstalled service feature allows you to use Active Directory synchronization accounts that are domain members not included in Administrators group to migrate passwords and/or SID History. The preinstalled service must be also configured for environments where Microsoft Local Security Authority (LSA) protection is used.

To use this feature the following requirements should be met:

• The Directory Synchronization Agent assigned for preinstalled service should be configured using the EnablePreinstalledMode.ps1 script as described below.
• Both source and target DC should be configured to provide the preinstalled service using the AllowAccess.ps1 script as described below.
• Source Active Directory synchronization account must have the permissions in the source domain as specified in Source Active Directory Synchronization Account Permissions.
• Target Active Directory synchronization account must have the permissions in the target domain as specified in Target Active Directory Synchronization Account Permissions.

Preinstalled service can be disabled when necessary as described in Disabling Preinstalled Service.

To configure source and target DC using AllowAccess.ps1 script

On the computer where Migration Manager is installed:

1. Copy Preinstalled Service folder located on the Migration Manager installation CD in the \QMM ResKit\Scripts subfolder to the %ProgramFiles%\Quest Software\Migration Manager\Common\BIN\DeployDistr folder.

2. Copy the following files from %ProgramFiles%\Common Files\Aelita Shared\ to the %ProgramFiles%\Quest Software\Migration Manager\Common\BIN\DeployDistr\Preinstalled Service folder:

   • aelagentms.exe
   • aelagentms64.exe
   • PwdHlp.dll
   • PwdHlp64.dll

The compiled preinstalled service distributive is now available by network in \\QMM_host\DSASetup\.

On source or target DC:

1. On the domain controller, run the PowerShell session as administrator.

2. Execute the following commands:

Net Use Z: \\QMM_host\DSASetup

Z:

cd “Preinstalled Service”

.\AllowAccess.ps1 <NetBIOSDomainName> <userName>

Where NetBIOSDomainName and UserName is the account specified for the domain in the domain pair configuration.

3. Repeat the actions 2-4 for target domain, specifying the domain and account specified for the domain in the domain pair configuration.
4. Restart the source and target DC.

To configure the Directory Synchronization Agent using the EnablePreinstalledMode.ps1 script

1. Stop all synchronization in progress on Quest Migration Manager console.
2. On the server hosting the Quest Directory Sync Agent, run the PowerShell session as administrator.
3. Open 32-bit (x86) version of the PowerShell prompt on the computer where Directory Synchronization Agent is hosted and execute the following commands:

Net Use Z: \\QMM_host\DSASetup

Z:

cd “Preinstalled Service”

.\EnablePreinstalledMode.ps1

4. Restart the synchronization jobs of the Directory Synchronization Agent that have been stopped on Quest Migration Manager Console on the step 1.

Disabling Preinstalled Service

To disable preinstalled service when necessary perform the following actions:

• Disable preinstalled service on a source and target DC
• Disable preinstalled service on a computer where Directory Synchronization Agent is hosted

All these actions should be performed to disable preinstalled service successfully.

To disable preinstalled service on a source and target DC

1. On source DC run the PowerShell session as administrator.
2. Execute the following commands:

Net Use Z: \\QMM_host\DSASetup

Z:

cd “Preinstalled Service”

.\DisableAccess.ps1

3. Repeat these actions for target DC.
4. Restart the source and target DC.
5. Optionally, you can remove the following files from the %Systemroot%\System32 on the source and target DC after they have been rebooted.

on computers running 32-bit Microsoft Windows

• aelagentms.exe
• PwdHlp.dll

on computers running 64-bit Microsoft Windows

• aelagentms64.exe
• PwdHlp64.dll

To disable preinstalled service on a computer where Directory Synchronization Agent is hosted

1. Stop all synchronization jobs that may be in progress on Quest Migration Manager console.
2. On the server hosting the Quest Directory Sync Agent, run the PowerShell session as administrator.
3. Execute the following commands:

Net Use Z: \\QMM_host\DSASetup

Z:

cd “Preinstalled Service”

.\DisablePreinstalledMode.ps1

4. Restart the synchronization jobs that were stopped on Quest Migration Manager Console.

Active Directory Processing

Account under which Active Directory Processing Wizard (ADPW) performs Active Directory processing must have the following permissions:

1. For processing Group membership grant account the Write Members permission on group objects.

2. For processing Linked attributes grant account permissions to Write corresponding linked attributes for processed objects.

3. For processing Active Directory permissions, the following permissions must be granted to the account:

• The Manage auditing and security log and Restore files and directories privileges in the Domain Controllers Policy
• The Modify permissions and Modify owner permissions on processed objects

4. For processing Default schema permissions grant account the Write defaultSecurityDescriptor permission on classSchema objects inside schema naming context.

5. For processing Exchange mailbox permissions, the account must have the following permissions:

• The Write msExchMailboxSecurityDescriptor and Write msExchMasterAccountSid permissions on processed objects.
• The Read All Properties and List content permissions on the Exchange organization using the following script in Exchange Management Shell:
  Get-OrganizationConfig | Add-ADPermission -User <ServiceAccount> -AccessRights "ListChildren, ReadProperty"
  
• The Administer Information Store and Modify permissions on the Exchange mailbox store where mailboxes reside using the following script in Exchange Management Shell:
  Get-MailboxDatabase | Add-ADPermission -User <ServiceAccount> -ExtendedRights ms-Exch-Store-Admin -AccessRights WriteDacl

6. For processing the Other Exchange permissions, the following permissions must be granted to the account:

• The Manage auditing and security log and Restore files and directories privileges in the Domain Controllers Policy
• The Read permissions, Modify permissions and Modify owner permissions on objects inside the Exchange configuration container
• The Read All Properties and List content permissions on the Exchange configuration container using the following script in Exchange Management Shell:
  Add-ADPermission -Identity (Get-OrganizationConfig).Identity.Parent -User <ServiceAccount> -AccessRights "ListChildren, ReadProperty"
• The Write msExchAdmins permission for msExchOrganizationContainer and msExchAdminGroup objects
• The Write msExchChatAccess permission for msExchChatChannel, msExchChatNetwork and msExchChatProtocol objects
• The Write msExchUserLink permission for msExchRoleAssignment objects

Exchange Server Processing

Account under which Exchange Processing Wizard performs Exchange servers processing must have the following permissions:

1. Read All Properties and List content permissions on the Exchange organization. To grant these permissions to the account, use the following script in Exchange Management Shell:

Get-OrganizationConfig | Add-ADPermission -User <ServiceAccount> -AccessRights "ListChildren, ReadProperty"

2. To process client permissions of mailboxes, grant the ApplicationImpersonation management role.

3. To perform public folder processing:

• The account must be mailbox-enabled
• For Exchange 2010 servers:
  • Grant membership in the Public Folder Management role group (Mail Enabled Public Folders, Public Folders roles) for processing client and administrative permissions of public folders

• For Exchange 2013 or later servers:

  • Account must have the ReadItems, EditOwnedItems, EditAllItems, FolderOwner, FolderContact, and FolderVisible on the public folders to be processed.

    -OR-

  • Grant FullAccess on a mailbox where public folders are located using the following script:
    Get-Mailbox "PublicFolderMailbox" –PublicFolder | Add-MailboxPermission -User "ServiceAccount" -AccessRights "FullAccess"