Archive Manager 5.9.1 - Installation and Configuration Guide for Exchange

Table 3. Account purposes
Account or group	Purpose
Exchange Storage Manager account (ArchiveMgr_ESM)	This account will be used to run the Exchange Store Manager Service. If you have a parent/child domain setup and are installing Archive Manager in the child domain, you need to create two accounts. An Exchange Store Manager account must be created in the child domain for the Archive Manager installation, and another Exchange Store Manager account must be created in the parent domain. Remember to make the account mailbox-enabled.
Archive Manager Service account (ArchiveMgr_Service)	This account will be used to run other Archive Manager services, the Web site, and any other processes that do not require specific access to Exchange.
Journaling account (ArchiveMgr_Journal)	This account will be used to access the journal mailbox. Remember to make the account mailbox-enabled.
Global security group (ArchiveManagerServiceUsers)	This group will include the Exchange Storage Manager account and the Journaling account.
Archive Manager Exchange Admins Group	A Domain Group containing the ESM Account. Note that this group is not created by the installer, so must be created manually. This account should be created before Archive Manager is installed. Group must contain the ArchiveMgr_Service and Archive- Mgr_ESM users. If journaling is enabled on the Exchange Server and a MAPI DataLoader is required, then the ArchiveMgr_Journal user must also be added to this group. This group must be granted Exchange "Receive-As" permission on all mailboxes. Should also be a member of the Exchange View-Only Adminstra- tors group.

Granting permissions to the Exchange Admin group

Microsoft Exchange security needs to be configured in order to run the Archive Manager Exchange Store Manager Service and to export email from the current Exchange store into Archive Manager.

We recommend that you create the Archive Manager Exchange Admin group and grant permissions to the group; however, you can instead just grant the permissions to a user. The advantage to adding the permissions to a group is that you don’t have to modify Exchange if you want to change the user; you can just add a user to or remove a user from the group.

Permissions can be granted at various levels within Exchange: at a site level, across multiple servers, on an individual server, or for a single mailbox.

To grant permissions in Exchange 2019, 2016, 2013 or 2010:

Add <your Archive Manager user or group> to the "View-Only Organization Management" role group.

Run this PowerShell command:

get-mailboxdatabase | add-adpermission -extendedright receive-as -user <your Archive Manager user or group>.

NOTE: These permission changes may take quite some time to propagate. To speed the process, it may be worth restarting the Exchange Information Store service or rebooting the Exchange server.

NOTE: When Exchange 2019, 2016 or 2013 works with Outlook 2019 or Outlook 2013 SP1 (32-bit, with KB3114941 and KB4022169 installed), and MAPI over HTTP is enabled on both ends,

•

The ESM service account must have full access permissions to the exported mailboxes. To grant full access, run the following command at the Exchange PowerShell command prompt:

Add-MailboxPermission -Identity <mailboxIdentity> -User <your Archive Manager user or group> -AccessRights FullAccess -InheritanceType All -AutoMapping $false

To test your changes, go to a PC that has Microsoft Outlook installed and sign in as the user or a user in the group to which you granted permission. Try to add the new mailboxes that have been created to that user's profile. If the user is able to access those mailboxes, the security has been configured successfully.