Setting Up the Target Active Directory Account
This section describes how to set the required permissions for the Target Active Directory Account used by Migration Manager for Exchange agents. This account is used for the following:
- Working with the target Active Directory
- Re-homing mailboxes
- Switching mailboxes (Migration Agent for Exchange)
-
Switching mailboxes and synchronize mailboxes in Remote Users Collections (Mail Source Agent, Mail Target Agent)
The required permissions for the Target Active Directory Account are as follows:
- Read access to the target domain
- Full Control permission on the organizational units (OUs) (and their child objects) where the target synchronized objects are located.
- Read permission for the Microsoft Exchange container in the target Active Directory
To set up the Target Active Directory Account, perform the steps described in the related subtopics.
|
|
NOTE: Note that these steps are given only as an example of a possible Target Active Directory Account setup. |
Changing the Default Source/Target Active Directory Account
Changing Default Active Directory Account
|
|
Caution: This section is relevant to the public folder synchronization only. Active Directory Account for mailbox or calendar synchronization is specified during corresponding job configuration. |
The default Source or Target Active Directory Account (initially displayed on the Associated domain controller page of the Exchange server's properties) is set when you add the source or target organization to the migration project (see the Registering Source and Target Organizations section of the Migration Manager for Exchange User Guide for details).
To change the Source or Target Active Directory Account, click Modify on the General | Associated domain controller page of the corresponding source (target) server properties in the Migration Manager for Exchange Console.
To go on using the default Source (Target) Active Directory Account for Exchange migration, grant the permissions required for Exchange migration to this account (see the next steps).
Granting Read Access to Active Directory Domain
The Target Active Directory Account used by Migration Manager for Exchange agents needs Read access to the target domain to work with servers and target Active Directory.
To grant this permission to the account, complete the following steps:
- On the target domain controller in the Active Directory Users and Computers snap-in, right-click the domain name, and then click Properties on the shortcut menu.
- On the Security tab, click Add and select the account to which you wish to assign permissions (in our example, QMM_Trg_AD).
NOTE: If there is no Security tab, you should select View | Advanced Features in the Active Directory Users and Computers snap-in.
- Select the account name, and then enable the Allow option for the Read permission in the Permissions box.
- Click the Advanced button. In the Advanced Security Settings dialog box, select the account you specified on step 2 and click Edit.
- In the Permission Entry dialog box, select This object and all descendant (child) objects from the Apply to drop-down list.
- Close the dialog boxes by clicking OK.
Granting Full Control on Organizational Unit (Target Active Directory Account)
To work with the target Active Directory objects, the Target Active Directory Account needs the Full Control permission on the organizational units and their child objects that contain the objects to be synchronized. This permission should be set on the domain controller where the objects you need to synchronize are located.
To grant the required permissions to the account, perform the following steps:
- In the Active Directory Users and Computers snap-in, right-click the OU where the objects are located, and click Properties.
- On the Security tab, click Add, and select the Target Active Directory Account (in our example, QMM_Trg_AD).
NOTE: If there is no Security tab, you should select View | Advanced Features in the Active Directory Users and Computers snap-in.
- Select the account name, and then enable the Allow option for the Full Control permission in the Permissions box.
- Click the Advanced button. In the Advanced Security Settings dialog box, select the account you specified on step 2, and click Edit.
- In the Permission Entry dialog box, select This object and all child (descendant) objects from the Apply onto drop-down list.
- Close the dialog boxes by clicking OK.