Granting Read Access to Active Directory Domain
The Source Active Directory Account used by Migration Manager for Exchange agents needs Read access to the source domain to work with servers and source Active Directory.
To grant this permission to the account, complete the following steps:
- On the source domain controller in the Active Directory Users and Computers snap-in, right-click the domain name, and then click Properties on the shortcut menu.
- On the Security tab, click Add and select the account to which you wish to assign permissions (in our example, QMM_Src_AD).
NOTE: If there is no Security tab, you should select View | Advanced Features in the Active Directory Users and Computers snap-in.
- Select the account name, and then enable the Allow option for the Read permission in the Permissions box.
- Click the Advanced button. In the Advanced Security Settings dialog box, select the account you specified on step 2 and click Edit.
- In the Permission Entry dialog box, select This object and all child (descendant) objects from the Apply onto drop-down list.
-
Close the dialog boxes by clicking OK.
Granting Read Permission for the Microsoft Exchange Container
In the source Exchange 2007 organization, the Source Active Directory Account requires the Read permission on the Microsoft Exchange container in the source Active Directory.
To grant this permission to the account, complete the following steps:
- Run the Exchange Management Console.
- Click the Organization Configuration node. The Exchange Administrators tab will appear on the right pane.
- Right-click anywhere in the Exchange Administrators tab and select Add Exchange Administrator from the shortcut menu.
- In the Add Exchange Administrator dialog box click Browse, select the Source Active Directory Account (in our example, QMM_Src_AD) and click OK.
- Select the Exchange View-Only Administrator role option and click Add.
-
Click Finish to exit the wizard and apply your changes.
|
|
Caution: If the Source Active Directory Account is located in another trusted forest, you cannot assign the Exchange View-Only Administrator role to this account. In this case grant the Read permission for the Microsoft Exchange container and its child objects to the account in the Configuration partition using the ADSIEdit snap-in. |
Setting Up Source/Target Agent Host Account
Setting Up the Agent Host Account
This section describes how to set the required permissions for the Agent Host Account used by Migration Manager for Exchange agents. This account is used to install and run Migration Manager for Exchange agents on agent hosts and to access the license server. The required privileges for the Agent Host Account are as follows:
- Membership in the local Administrators group on the license server (unless alternative credentials are used for the license server). If server is located in another trusted forest, the account should have local Administrator permissions on the license server
- Local Administrator permissions on the agent host server.
- Permission to create, read and write SCP in domain where agent host resides. The SCP object is located in the CN=Exchange Migration Project,CN=QmmEx,CN=Migration Manager,CN=Quest Software,CN=System,DC=eternity,DC=<...> ,DC=<...> Active Directory container.
- The db_owner role on the SQL server where the database resides. Note that this permission is required if you use Windows authentication option for connecting to SQL Server.
|
|
NOTE: By default each Exchange server is an agent host for itself. If you use the default agent host then to simplify the account setup process, you can grant these permissions to the Exchange Account and use it instead of the Agent Host Account. |
To set up the Agent Host Account, perform the steps described in the related subtopics.
|
|
nOTE: Note that the steps are given only as an example of a possible Agent Host Account setup. |
Changing the Default Source Agent Host Account
The default Source Agents Host Account (initially displayed on the Default Agent Host page of the Exchange server Properties) is set when you add the source organization to migration project (see the Registering Source and Target Organizations section of the Migration Manager for Exchange User Guide for details).
If necessary, you can change the default Source Agent Host Account by clicking Modify on the General | Default Agent Host page of the corresponding source server properties in the Migration Manager for Exchange Console.
To go on using the default Source Agent Host Account for Exchange migration, grant the permissions required for Exchange migration to this account (see the next steps).