Chat now with support
Chat with Support

Collaboration Services 3.9 - Deployment Guide

About this document About Collaboration Services Architecture and functionality Before you begin Platform considerations Pre-installation planning Prepare for use Collaboration Services upgrade Installation checklists Re-installing Collaboration Services Troubleshooting

Prepare for use checklist

•
Generate a branch public key file in each branch.
The public key file of each branch forest is required for the administrator of the HQ forest to register the branch forests in the collaboration structure.
The Export Key Wizard, which allows for exporting the branch public key, automatically appears when you first open the user interface in a branch.
•
Securely transfer each branch’s public key file to the HQ forest administrator.
The HQ administrator needs each branch’s public key file to register the branch in the collaboration structure.
•
Register the branch forests in the collaboration structure
The Configure Branches Wizard, which allows for registering branches in the collaboration structure, automatically appears when you first open the user interface in the HQ forest.

 

Re-installing Collaboration Services

To re-install Collaboration Services and maintain reliability between Exchange organizations and maintain stub objects
1
Perform a backup and restore of Collaboration services. For details, see the Quest Collaboration Services User Guide.
2
Stop all Collaboration Services services.
3
Move all stub objects from the Quest Collaboration Services Objects OU to a temporary OU.
* 
NOTE: All locations that receive objects from here will have to move Stub objects to a temporary OU as well.
4
Uninstall Collaboration Services.
5
Ensure that all registry keys under HKEY_LOCAL_MACHINE\SOFTWARE\Aelita\AelitaCollaborationServices and all files in the Collaboration Services installation folder are removed.
* 
NOTE: The removal of the top level Aelita key may affect other Quest products if installed on the same computer.
6
Install Collaboration Services following the steps in the Collaboration Services Deployment Guide.
* 
NOTE: If during the re-install and error message, "Class Not Registered", is received please see Knowledge Article 65960 which can be found at https://support.quest.com/SolutionDetail.aspx?id=SOL65960.
7
Generate new key.
8
On the Collaboration Services console, select Properties | Synchronization | Automation | Deletion, configure a resolution rule to delete conflicted objects in the container where the original stub objects were moved.
* 
NOTE: It is important to only specify the temporary OU, as these are the only accounts that should be deleted through this process.
* 
NOTE: The deletion rule will have to be created in all locations where you have moved stub objects into a temporary OU.
9
Obtain partners key (keys) and register where you installed Collaboration Services.
10
Send the new key generated in step 7 to the synchronization partners and re-register.
If you need to preserve stub objects in a mail-enabled state at all times, all stub objects created for the reinstalled partner must be moved out of Collaboration Services container to a temporary OU before importing a new key. Then, set up automatic conflict resolution through a deletion and allow it to happen for this temp OU similar to described in step 8.
After importing a new key, all subscriptions to the re-installed partner will disappear and need to be recreated again.
11
Re-create all publications and subscriptions as they were in the original installation.

 

Troubleshooting

This section describes the common error messages that can appear during Collaboration Services setup and the actions to take to resolve the issue:

Table 1. Common error messages
Error message
Possible reason
Solution
Unable to enumerate Exchange servers in this forest
The setup account does not have the Exchange View Only Administrator role.
Using Exchange System Manager, grant the Exchange View Only Administrator role to the setup account.
After installation of Collaboration Services is complete, you can remove this privilege from the setup account.
Unable to access container for ACS stub objects, please specify another
The setup account does not have the Full Control permission over the Active Directory container selected for creating stub objects.
Using Active Directory Users and Computers, grant the setup account Full Control permission over the selected container.
Unable to find mailbox or mailbox name is ambiguous
The specified mailbox either does not exist or the specified name is ambiguous (for example, there is more than one object with that display name).
Specify the full mailbox address.
 
Service failed to start
 
The service account does not have Local Administrator privileges on the computer where the Collaboration Services instance is installed.
Add the service account to the Local Administrators group on the computer where the Collaboration Services instance is installed.
A constraint violation occurred
The setup account does not have Full Control permission over the child objects in the Active Directory container selected for creating stub objects.
 
Using Active Directory Users and Computers, grant the setup account Full Control permission over the selected container. Select the This object and all child objects option when granting the permission.

Service account minimum rights and permissions

The account used as the service account should also be used to install and configure Collaboration Services.

* 
NOTE: The full administrative rights for Exchange are different for each version. Refer to the Quest Support site (https://support.quest.com) for the latest information on the required rights.

If your organization’s security policies do not allow full administrative permissions to be set, you can set the minimum permissions listed in the table to successfully install and configure Collaboration Services.

As a best practice, all of the following actions should be performed by one account and therefore, this account needs the rights for each action. For example, you could use an Administrative account to install Collaboration Services and a different account as the service account for Collaboration Services. In this case, the service account would need the rights for the "Run the services required by the Collaboration Services application" and "Minimum access in the domains" action to ensure the account has the necessary permissions on the local computer and the domain.

Table 2. Required permissions
Action
Used to
Required permissions
Notes

Install and Setup

Run the Collaboration

Services setup and

deploy the software.

This also includes

installing services on the

computer.
•
Exchange View Only Administrator role
•
Local Administrator on the computer where Collaboration Services is installed
•
Full Control permission for the Collaboration Services container

Be sure to log on to the server with this account before launching the setup.

When installing the service, you can use the setup account as a service account. You can use another account if required.

Run the services required by Collaboration Services application

Start the synchronization services on the computer where Collaboration Services installed.
•
Local Administrator privileges on the computer where the Collaboration Services instance is installed.
•
Full Control to service mailboxes on Exchange
•
Full Control to child objects of Active Directory container where Collaboration Services stubs will be created.

After Collaboration

Services is installed, the

service account used to run the Collaboration Server services should also be given the rights for General Usage in the domains.

 

You can change it to another account if required.

Minimum access in the domains

Read and update Active Directory data
•
Read access to Active Directory
•
Replicate Directory Changes right for all domains in the forest from which objects will be published
•
Manage Replication Topology right for all domains in the forest from which objects will be published
•
Write, create, and delete objects rights for the Collaboration Services container and child containers
•
Delete object rights for all containers with objects that are subject to conflict resolution through deletion
•
Write permission for all objects that are subject to matching
•
Modify group membership right for all groups whose members can be affected by conflict resolution through deletion or matching
•
Modify permissions for all stores in the Configuration container where Collaboration Services' Calendar stub objects are stored.

If objects that are subject to conflict resolution through deletion or matching can be scattered all over the forest, be sure to give this account sufficient privileges so it can update or delete objects located in different domains and containers and change the membership of different groups throughout the forest.

(Continued)

(Continued)

The Modify Permission right can be set through ADSI Edit.

1. Locate the store in the configuration container, right-click and select Properties.

2. Select the Security tab, and click the Advanced tab.

3. Select the account used for Collaboration Services, and click Edit. (If the account does not appear in the list click the Add button.)

4. Grant the Modify Permission right and save your changes.

(Continued)

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating