Microsoft® Exchange Server 2003 Deployment and Migration

Kieran McCorry is a Principal Consultant in HP CI's Enterprise Microsoft Services Team, part of the Technology Leadership Group. Kieran works extensively with the planning, design, and implementation of messaginginfrastructures for many of HP's largest worldwide customers. A frequent speaker at many industry events such as Microsoft TechEd, Kieran is also a regular columnist in the Exchange and Outlook Administrator Newsletterand writes frequently for Windows .Net Magazine. He is author of the book, Connecting Microsoft Exchange Server, (Digital Press, 1999) and co-author with Donald Livengood of the book, Exchange 2000Infrastructure Design, (Digital Press, 2001).

"Clearly the topic of migration and deployment is in Kieran's sweet spot. The entire topic is like a fastball floating right down the middle for him because he absolutely hits a home run in this book. He doesn't just talk about what different components are involved with migration and deployment, he describes how everything works and why you might take different approaches in your deployment. It's right on the money!"— Donald Livengood, Senior Solution Architect (MCSE, MVP, HP Certified Architect), Hewlett-Packard Company"In his new book, Kieran outlines clear, concise, and crisp guidelines for migration and deployment of Exchange messaging systems. Armed with this generally hard to find knowledge, you'll be prepared for most Exchange 2003 implementation projects. His principles have been well used in the past-not least for the implementation of a 350,000 user Exchange system in my own organization." — Roy Beattie, Messaging and Integration Director, NI Schools C2k Project"Kieran has been working with us since 1999, originally on the AstraZeneca merger work and more recently on our Exchange 2003 project. This book demonstrates Kieran’s expertise in deployment and migration and is particularly strong on Directory Synchronization, which is a fundamental component of a migration from Exchange 5.5 to 2003. You’ll get quite the level of detail that you need, presented in a format that is easily digestible in this work." -- Dave Cook, Global Messaging Architect, Astra Zeneca Healthcare

• DedicationForewordPreface What is This Book about?Intended AudienceAcknowledgments1: Exchange 2003 Deployment Fundamentals 1.1 Introduction1.2 Windows 2000/Windows 2003 Refresher1.3 Exchange 2003 and Its Relationship to the Forest1.4 The Importance of Domain Controllers and Global Catalog Servers1.5 Choosing an Appropriate Domain Model1.6 Universal Security Groups and Windows Domain Mixed-Mode Membership1.7 Token Augmentation1.8 Exchange 2003 Installation Requirements1.9 Exchange System Manager on Windows XP1.10 Exchange 2003 and Internet Information Services 6.01.11 Exchange 2003 Installation Improvements1.12 Preparing and Planning for Deployment1.13 DCDiag and NetDiag Utilities1.14 Preparing Windows 2003 Domains for Exchange 20031.15 Installing Exchange 20001.16 Summary2: Active Directory Connector Synchronization 2.1 Introduction2.2 Active Directory Connector Core Technology Description2.3 Connection Agreements2.4 Active Directory Connector Schema Modifications2.5 Determining Which Directory Objects to Synchronize2.6 Active Directory Connector Block Searching2.7 How the Active Directory Connector Uses the Active Directory2.8 Mailbox-enabled and Mail-enabled Objects2.9 Object Class Mapping from Exchange 5.5 to the Active Directory2.10 Object Class Mapping from the Active Directory to Exchange 5.52.11 Synchronizing Hidden Objects2.12 Dealing with Hidden Distribution List Membership2.13 Object Deletion2.14 Connection Agreements and Authentication2.15 Controlling the Synchronization Schedule2.16 Connection Agreement Advanced Parameters2.17 Exchange 5.5 Mailboxes and Multiple Windows NT Accounts2.18 Mailbox Delegate Access2.19 Troubleshooting Active Directory Connector Synchronization Problems2.20 The New Exchange 2003 Active Directory Connector Features2.21 Summary3: Advanced Active Directory Connector Configuration 3.1 Introduction3.2 Default Object-Matching Behavior3.3 How the Active Directory Connector Uses LDAP3.4 Using a Customized LDAP Search Filter3.5 Understanding LDAP Search Filters3.6 Setting an LDAP Search Filter on a Connection Agreement3.7 Default Active Directory Connector Object-Matching Behavior3.8 Using Custom Object-Matching Rules on the Active Directory Connector3.9 The NTDSNoMatch Utility3.10 Summarizing Object-Matching Behavior3.11 Introduction to Attribute Mapping3.12 Default Attribute Mapping Behavior3.13 Moving Beyond the Schema Mapping GUI3.14 Active Directory Distinguished Name Mapping with the Exchange 2000 Active Directory Connector3.15 Distinguished Name Mapping with the Exchange 2003 Active Directory Connector3.16 Exchange 5.5 and LDAP Names3.17 Attribute Mapping Rule Syntax3.18 Summary4: The Site Replication Service 4.1 Introduction4.2 Positioning the Site Replication Service and the Active Directory Connector4.3 Components that Comprise the Site Replication Service4.4 The Site Replication Service in Intrasite Replication Operation4.5 The Site Replication Service in Intersite Replication Operation4.6 What Takes Place during a Bridgehead Server Upgrade?4.7 Site Replication Service Management4.8 Site Replication Service Preference4.9 Summary5: Public Folder Interoperability and Migration 5.1 Introduction5.2 Public Folder Connection Agreements5.3 Configuring Public Folder Connection Agreements5.4 Public Folder Permissions5.5 Exchange 5.5 and Exchange 2003 Public Folder Replication5.6 Permission Handling during Mixed-Version Replication5.7 Dealing with Zombie Users5.8 Exchange 5.5 Distribution Lists and Access Control Lists5.9 Public Folder Deployment Guidelines5.10 Planning and Understanding Public Folder Topologies5.11 Reintroducing Public Folder Affinity5.12 Getting Ready to Migrate Public Folders5.13 Moving User and System Public Folder Content5.14 Using the Public Folder Migration Tool5.15 Summary6: Deployment and Interoperability Guidelines for the Active Directory Connector 6.1 Introduction6.2 Why Native-Mode Windows 2000 or Windows 2003 Domains Are Best6.3 Scenarios that Require Multiple Connection Agreements6.4 Container Hierarchy Mapping6.5 Moving Synchronized Objects between Containers6.6 Using Multiple Active Directory Connectors6.7 Exchange 5.5 Back-Replication6.8 Connection Agreement Deployment Models6.9 Deploying Active Directory Connectors6.10 Network Impact from Active Directory Connector Synchronization6.11 Summary7: Moving from Exchange 5.5 to Exchange 2003 7.1 Introduction7.2 Exchange 5.5 Migration Fundamentals7.3 Making a Clean Break from Exchange 5.57.4 Exchange 5.5 Migration Terminology Refresher7.5 The Importance of sID History During Exchange 5.5 Migration7.6 Exchange 5.5, Windows Migrations, and the ClonePrincipal Toolkit7.7 Requirements for Writeable Access to sIDHistory7.8 Running Exchange 5.5 on Windows 2000 Servers7.9 Exchange 5.5 to Exchange 2003 Migration Approaches7.10 Active Directory Account Domain Cleanup Wizard7.11 Summary8: Moving from Exchange 2000 to Exchange 2003 8.1 Introduction8.2 Exchange 2000 to Exchange 2003 Migration Approaches8.3 Mixed Exchange 5.5/Exchange 2000 migrations to Exchange 20038.4 The Exchange 2003 Move Mailbox Wizard8.5 Summary9: Interorganization Migrations 9.1 Introduction9.2 Deciding on an Interorganization Migration Approach9.3 Using the Exchange Server Migration Wizard9.4 Partial Organization Migrations9.5 Third-Party Migration Tool Approach to Interorganization9.6 Summary10: Deploying Exchange for External Access 10.1 Introduction10.2 Using Exchange 2003 Front-End Servers in the DMZ10.3 Exchange, DSAccess, and Firewalls10.4 Should You Allow RPCs across Your DMZ?10.5 Generalized Internal-Facing Firewall Requirements10.6 Outlook Web Access Security Issues10.7 Secure Architectural Alternative10.8 Tunneling and Bridging10.9 Putting Components into Practice10.10 Using Microsoft ISA Server with OWA10.11 Using a Hardware-Based SSL/TLS Proxy Server with OWA10.12 Back-End Encryption10.13 Understanding OWA, Authentication, Front-End Servers, and Redirection10.14 Implementing Outlook RPC over HTTP10.15 SummaryA: Lists of Events Generated by the Active Directory ConnectorB: Connection Agreement AttributesC: Active Directory Connector Registry KeysIndex