-
Title
How does QMM (Quest Migration Manager) handle "Send on Behalf" mailbox permission? -
Description
Many organizations are relying on delegation model where "Send on Behalf" permission is granted to VIP assistants or used for shared mailboxes. How does QMM handle migration of such permissions? Is there going to be a problem in "Exchange only" migration scenarios where the QMM for AD portion is not licensed and the ADPW (Active Directory Processing Wizard) is not available.
-
Resolution
Delegates (Send on Behalf) can be configured in two ways:
1. ADUC (Active Directory Users and Computers) - Exchange General tab - Delivery Options button
2. From within Outlook Tools - Options - Delegates
QMM for Exchange was designed in such a way that it would not cause any complications for those who do not need the QMM for AD side of product. Mailbox delegation (Send on Behalf - completely different from Send As) is stored in "publicDelegates" Active Directory attribute and comes over during Directory Synchronization regardless of "Security Descriptor migration rule:" settings that synchronizes directory permissions. No ADPW processing is required in this case.Separate attention deserves Intra-forest scenario:
- AD Migration without "Reconnect Mailboxes". Delegates in the publicDelegates attribute are resolved only to the target migrated corresponding users. Unresolved Links errors are logged for those accounts from domains others then the target.
- Exchange Migration with "Reconnect Mailboxes" option. Delegates in the publicDelegates attribute are resolved for those that can be found in the target domain, otherwise just copied.
For example:Forest TEST, domains D1.TEST.LOCAL, D2.TEST.LOCAL
D1 has SUser with Delegates SDelegate1 and SDelegate2, SDelegate3 from D1
Migrating SUser and SDelegate1. The publicDelegates attribute of migrated TUser from D2 has TDelegate1 (corresponding to SDelegate1)Migrating SUser with Reconnect Mailbox. The publicDelegates attribute has TDelegate1, SDelegate2 and SDelegate3
NOTE: If SDelegate2 and SDelegate3 are migrated after SUser then publicDelegates attribute will still contain source users. This is because QMM does not resolve back links. In order to resolve this problem SUser needs to be re-migrated or ADPW (Active Directory Processing Wizard) performed on the target domain D2. This will turn SDelegate2 and SDelegate3 into TDelegate2 and TDelegate3 in publicDelegates attribute of TUser. -
Additional Information
Please see the following solutions for additional info related to this and Shared As issues:
Solution SOL53788 - AD permissions are not fully migrated from source to target - https://support.quest.com/kb/53788Solution SOL48950 - Values in the publicDelegates linked attribute that point to groups are not resolved. They are left in Unresolved Links queue. - https://support.quest.com/kb/48950
Solution SOL22936 - How to handle the migration of shared or delegated mailboxes? - https://support.quest.com/kb/22936