Network Security Considerations and Options
Different organizations have different network security standards that determine the number and
configuration of user accounts necessary to perform a migration. The most straightforward approach is
to configure a single migration admin account in Active Directory with all the necessary rights in both AD
and Exchange to run a full migration:
• In Active Directory, this account must be added to the Domain Admins group. On each Exchange
Mailbox Store to which the users are migrating, the account must be added to the security access
control list with at least Receive As rights. This single account must then be used to login to the
migration workstation, and provide the Exchange Server credentials and the Active Directory
credentials in Notes Migration Manager. Many organizations, however, prefer not concentrating that much
administrative authority in a single account. The alternative is to configure two separate accounts, each
with more restrictive access rights, to perform different portions of the overall migration process. For example:
• One account to login to the migration workstation: A domain user account in Active
Directory, with Read/Write delegate access on all OUs where users and groups will be
provisioned. On the Exchange server, this account will need Exchange Administration delegate
access to the Administrative Group where the users’ mailboxes will be created. This account must
then be used to login to the migration workstation.
Note for Exchange 2007 or 2010 migrations:The user logged into the workstation must be
a member of the Domain Administrators group.
• A separate account to provide Exchange Server credentials and AD credentials within
Notes Migration Manager:A user object in Active Directory, added to the Domain Users group.
|On every Exchange Mailbox Store, this account must be added to the security access control list
with at least Receive As rights. (In Windows Server 2008 R2, you can set Receive As permissions
by Start | Programs | Administrative Tools | Active Directory Users and Computers.)
Requirement Specifications
Notes/Domino Server
• An account must be defined with admin rights to the Domino server. You can use the admin
account created by Notes/Domino upon installation, or create a new account and add it to the
LocalDomainAdmins group.
Exchange Server
• An account must be defined with access to the Exchange environment. (A new account with
"Receive As" rights to each mailbox store, and not assigned to any group, would be suitable for
this purpose.)
• If migrating to Exchange 2010: Remote management must be enabled on the Exchange
|server. (See How Do I Enable Remote Management on an Exchange 2010 Server? in the
Appendix of the Administration Guide.
For Exchange 2003 (only):Recipient Update Service must be set to Always Run.
Active Directory Server
It is possible to configure a single migration admin account in AD with all the necessary rights in both
AD and Exchange to run a full migration, but many organizations prefer not concentrating that much
administrative authority in a single account. See Network Security Considerations and Options above for more
information, and the requirements for the AD admin account(s). Also:
If migrating to Exchange 2010: This AD account must be configured with remote PowerShell enabled.
Issue this command through the Exchange Shell:
Set-User <alias> -remotepowershellenabled $true
... where <alias> is the AD account to which you're granting access.
If your AD is configured for a resource forest and a user forest: In the resource forest, you will
need the standard set of permissions as cited above. In the user forest, you will need an account that
simply has read permissions to the AD, such as a domain user. The software doesn't make any changes to
the user forest; it only performs searches.
Access to Microsoft SQL Server Required
• Access to a Microsoft SQL Server is required, installed either on the admin's migration
workstation or on a separate server.
• You may use an existing (installed) Microsoft SQL Server version 2000, 2005, 2005 Express, or
2008, or you can download and install a free copy from Microsoft, from the link provided in the
NME AutoRun installer.
• Note that NME running with SQL Server 2008 requires the SQL 2005 Native Client on the admin's
workstation to communicate with SQL. The SQL 2008 Native Client is not supported at this time.
• The SQL bulk insert directory (specified in the SQL Server Configuration screen of Notes
Migration Manager) must be accessible to all migration workstations, and to the user that the
SQL Server will run as.
Note:The account that the SQL server is running as and the account used to run NME (logged onto the
NME workstation) both must have read and write access to the bulk insert shared directory (\\example\bulk),
and the NME account must be able to perform a bulk insert operation. While a SQL Authentication account can
be configured to run bulk insert, it makes more sense to use only a Windows domain account, which will
require bulk insert rights anyway.
