Managing Collections with LDAP filters. (4306654)

Migration Manager has several features for populating mail and calendar collections.

The focus of this article is for adding and controlling collection members via "Dynamic LDAP filters."

Collections that match the same users by using LDAP filters will be processed by those collections.

This may create unintended consequences and must be managed.  

This behavior is inherent to Dynamic LDAP filtering with collections.

LDAP filters are executed dynamically and therefore have no practical way to compare adjacent collection filters for inclusive overlapping members at that time. 

In order to use dynamic LDAP filtering you are required to control member inclusion and exclusion for any overlapping users, thereby ensuring users are mutually exclusive between collections.

For example, if you have two collections using different LDAP filters, yet those filters find the same user, both collections will operated on that same user and potentially cause unintended behavior.

How to control member inclusion or exclusion:

To control users included or excluded from a collection stamp attribute values to currently unused/available attributes.

For example, in the source Active directory choose a user that you plan to migrate by "Collection 5". 

1. Choose a free attribute of that same user and modify it with some flag.  Try "ExtensionAttribute1" on the user to hold the stamp. Using any AD tool capable of modifying attributes set  "ExtensionAttribute1=SyncMeInCollection5"
2.  Choosing "SyncMeInCollection5" as the stamp is fine.
3. Next configure the Mail Agent collection with an LDAP filter as follows.
4. Create a mail collection and name it "Collection 5"
5. Under "Add members" portion of the collection configuration wizard goto "Advanced" and add the LDAP filter.  In this case the filter would be (ExtensionAttribute1=SyncMeInCollection5) and this is subsequently added to the overall filter used.

That will complete the inclusion of any user holding the variable "ExtensionAttribute1=SyncMeInCollection5".  

To explicity exlude the user from another collection with an LDAP filter you could simple add

(!ExtensionAttribute1=SyncMeInCollection5)

Note the "!" prefixed on the filter.  This means exclude the user containing this stamped attribute.

This will successully control which collection has the responsibility to migrate any particular user.