Register domains with Active Roles
Register domains with Active Roles
Exchange Resource Forest Management requires the following domains to be registered with Active Roles:
- In the Exchange forest, a domain that hold computers running the Mailbox server role
- In each accounts forest, the domains that hold the users you want to administer with Active Roles
When registering a domain, you are prompted to choose which account you want the Administration Service to use to access the domain. You can either specify a so-called override account or let the Administration Service use its service account. With either option, the account must have sufficient rights in the domain you are registering. At a minimum, the account must have the following rights:
- Member of the Account Operators domain security group
- In case of Exchange 2013, member of the Recipient Management role group in the Exchange forest (see “Access to Exchange Server/Exchange 2013” in the Active Roles Quick Start Guide), and enabled for remote Exchange Management Shell (see “Support for remote Exchange Management Shell” in the Active Roles Quick Start Guide)
- In the Exchange forest, read access to Exchange configuration data (see “Permission to read Exchange configuration data” in the Active Roles Quick Start Guide).
For instructions on how to register domains with Active Roles, see “Adding and removing managed domains” in the Active Roles Administrator Guide.
Applying the Policy Object
Active Roles provides a built-in Policy Object containing the mailbox management policy for Exchange resource forest topology. To enable Exchange Resource Forest Management, you need to:
Link that Policy Object to the appropriate containers in the accounts forest. These are the containers that hold the user accounts you want to administer using Exchange Resource Forest Management.
Optionally, view or change policy settings.
To link the Policy Object to an organizational unit or domain
- In the Active Roles console tree, select Configuration | Policies | Administration | Builtin.
- In the details pane, right-click the Built-in Policy - ERFM - Mailbox Management Policy Object, and then click Policy Scope.
- In the dialog box that appears, click Add, and then select the desired organizational unit or domain in the accounts forest.
Out of the box, the Policy Object has all policy settings configured. You can use the Active Roles console to view or change policy settings as needed.
To view or change policy settings
- Double-click the Built-in Policy - ERFM - Mailbox Management Policy Object.
- In the Properties dialog box that appears, go to the Policies tab, and double-click the entry in the list of policies.
- In the Properties dialog box that appears, do any of the following:
- On the Shadow Account tab, view or change the container and default description for new shadow accounts.
- On the Master Account tab, view or change the attribute to store a reference to shadow account.
- On the Synced tab, view or change the list of synchronized properties.
- On the Substituted tab, configure your custom list of substituted properties in addition to the default list.
- On the Back-synced tab, view or change the list of back-synchronized properties.
For detailed description of the policy settings, see Policy settings earlier in this document.
Upgrade from an earlier version
You can seamlessly upgrade from Quick Connect for Exchange Resource Forests to Exchange Resource Forest Management, as follows.
- Inspect your current configuration of Quick Connect for Exchange Resource Forests, and note down the existing policy settings such as:
- The container for new shadow accounts, identified by the Default Mailbox OU policy parameter.
- The default description for new shadow accounts, identified by the Shadow account description policy parameter.
- The attribute to store a reference to shadow account, identified by the Attribute to store back link policy parameter.
- The list of synchronized properties, identified by the Synchronized Attributes List policy parameter.
- The custom list of substituted properties (if any)), identified by the Substituted Attributes List policy parameter.
- The list of back-synchronized properties, identified by the Back-synchronized attributes list policy parameter.
For instructions on how to access policy parameters, see the “Set Up and Apply the Policy Objects” topic in the Quick Connect for Exchange Resource Forests Administrator Guide.
- Uninstall the earlier version of the ERFM add-on from the system.
NOTE: If ERFM (Exchange Resource Forest Management) is installed on the Active Roles 6.x version, it must be uninstalled before installing Active Roles 7.4, as ERFM is now part of the product. Failure to uninstall ERFM may result in conflicts and issueseplace this text with a description of a feature that is noteworthy.
- Upgrade to Active Roles version 7.5. For upgrade instructions, see the Active Roles 7.5 Quick Start Guide.
- Adjust the policy settings in the Exchange Resource Forest Management Policy Object to match the settings you noted down in Step 1, and then link that Policy Object to the containers that hold the master accounts you managed using Quick Connect for Exchange Resource Forests. For instructions on how to configure and link that Policy Object, see Applying the Policy Object earlier in this document.
After you have performed these steps, Exchange Resource Forest Management recognizes the existing master accounts, enabling Active Roles to manage their linked mailboxes in the same way as when using Quick Connect for Exchange Resource Forests.
To expedite the recognition of the existing master accounts, you might execute the Exchange Resource Forest Management scheduled task without waiting for its scheduled run: In the Active Roles console, navigate to the Configuration/Server Configuration/Scheduled Tasks/Builtin container, right-click the task ERFM - Mailbox Management in that container, point to All Tasks, and then click Execute.
Examples of Use
