Active Roles 7.2.1 - Exchange Resource Forest Management Administrator Guide

Making changes to synchronized properties

When you update certain properties of a master account, Exchange Resource Forest Management updates those properties in both the master account and shadow account. These properties are referred to as synchronized properties. For details, see Synchronized properties earlier in this document.

To verify the behavior of synchronized properties

1. In the Web Interface, select a mailbox-enabled user account held in the Accounts OU, and then choose the General Properties command.
2. On the General tab, make changes to the First name or Last name field.
3. Go to the Organization tab and make changes to the Title, Department, or Company field.
4. Click Save to apply your changes.
5. Locate the shadow account in the Mailboxes OU—the name of the shadow account is identical to the name of the master account you have modified in the Accounts OU.
6. Choose the Properties command for the shadow account.
7. Examine data on the General and Organization tabs to verify that the changes you have made to the master account are also applied to the shadow account.

You can review the updates to the account properties by using the Change History command on the master account and on the shadow account—the Change History results provide information on which properties were updated, what changes were made to the properties, who performed the update, and when.

Making changes to substituted properties

When you view or change certain properties of a master account in an accounts forest, Exchange Resource Forest Management redirects the retrieval or change request to the properties of the shadow account in the Exchange forest. Such properties are referred to as substituted properties.

All the substituted properties that are mandatory for Exchange Resource Forest Management to work are listed in the Substituted properties section, earlier in this document. These properties used to store mailbox settings. As mailboxes are located in the Exchange forest, the updates to such properties need to be performed on the shadow accounts. Exchange Resource Forest Management implements a mechanism for capturing updates to substituted properties on the master account side and then applying those changes on the shadow account side.

You can view or modify some of the substituted properties on the Web Interface pages for managing Exchange recipient properties of a mailbox-enabled user account in the Accounts OU.

To view or change Exchange properties on the master account

1. In the Web Interface, select a mailbox-enabled user account held in the Accounts OU, and then choose the Exchange Properties command.
2. View or change the settings on the following tabs:
   • General
   • E-mail Addresses
   • Mailbox Features
   • Mail Flow Settings
   • Mailbox Settings
3. Click Save to apply your changes.

Once you have completed these steps, your changes are applied to the shadow account associated with the master account you were administering. You can verify this by using the Change History command on the shadow account. The Change History results indicate that the changes were actually made to the properties of the shadow account, in the Mailboxes OU.

Account deprovisioning

When you use Active Roles to deprovision a master account, Exchange Resource Forest Management causes Active Roles to deprovision the shadow accounts as well. In this way, Active Roles deprovisions the master account’s mailbox. You can verify this behavior by using the Active Roles Web Interface.

To deprovision a master account

• In the Web Interface, select a mailbox-enabled user account held in the Accounts OU, and then choose the Deprovision command.

Once you have completed these steps, the Deprovision command is performed not only on the master account but also on the shadow account. You can verify this by using the Deprovisioning Results command on the shadow account in the Mailboxes OU.

Membership management delegation

This section shows how Exchange Resource Forest Management facilitates delegation of the membership management task for distribution lists. To perform the procedures in this section, you need the following environment:

• Exchange Resource Forest Management configured as described in the Configuration section earlier in this document.
• A mailbox-enabled user account named John Smith created by Active Roles in the Accounts OU, so the shadow account for that user account exists in the Mailboxes OU.
• For the user account John Smith, on a computer in the accounts forest, Microsoft Outlook configured to connect to the mailbox of that user account.
• A mail-enabled group named DL, representing a certain distribution list, created in the Mailboxes OU.

The following procedure demonstrates how to delegate the task of managing the DL membership list to the user account John Smith.

To delegate the membership management task

1. In the Active Roles Web Interface for Administrators, open the Exchange Properties page for the user account John Smith:
   • Locate and select the Accounts OU.
   • Select the user account John Smith in the list of objects held in that OU.
   • Click the Exchange Properties command.
2. On the Exchange Properties page, go to the Shadow Account tab, and click the Properties button on that tab.

This opens the General Properties page for the shadow account.

3. On the General Properties page, click the Account tab and note down the pre-Windows 2000 logon name of the shadow account.
4. In the Web Interface, open the Managed by tab for the DL group:
   • Locate and select the Mailboxes OU.
   • Click the DL group in the list of objects held in that OU.
   • Click the Managed by tab on the General Properties page that appears.
5. On the Managed by tab, click the Change button under the Manager box.

This opens the Select Object dialog box allowing you to specify the manager account.

6. Use the Select Object dialog box to find and select the shadow account:
   • In the Name box, type the name of the shadow account you noted down in Step 3.
   • Click Search.
   • Click Search.
   • In the list of search results, click the name of the shadow account.
   • Click OK to close the Select Object dialog box.
7. On the Managed by tab, click Save; then, select the Manager can update membership list check box, and click Save again.

Although you have specified the shadow account as the manager of the group, Active Roles updates security settings on the group so that the master account is authorized to add or remove members from the group by using conventional tools such as Microsoft Outlook.

If you clear the Manager can update membership list check box, or change the manager of the group, Active Roles updates the security settings to revoke the former manager’s right to modify the membership list of the group.

After you have specified the shadow account as the manager of the DL group with the Manager can update membership list option, force Active Roles to give the manager rights to the master account by executing the scheduled task ERFM - Mailbox Management held in the Configuration/Server Configuration/Scheduled Tasks/Builtin container or wait for a scheduled run of that task. Then, you can verify that the master account can use Microsoft Outlook to add or remove group members, provided that Outlook is configured to connect to the mailbox for the John Smith user account:

1. Log on with the name and password of the John Smith account to the computer where Microsoft Outlook is configured to connect to the linked mailbox of that user account.
2. Open Outlook and press Ctrl+Shift+B to display the Address Book.
3. In the Address Book, double-click the DL group.
4. On the General tab in the dialog box that appears, click Modify Members to add or remove members from the DL group.