Active Roles 7.2 - Exchange Resource Forest Management Administrator Guide

Exchange Server deployment

Exchange Resource Forest Management requires Exchange 2010 or later to be deployed in the Exchange forest.

Exchange Server should not be installed in the accounts forests. The Active Directory schema in the accounts forests does not need to be extended with the Exchange Server attributes.

A trust between the Exchange forest and the accounts forest must be set up before you can use Exchange Resource Forest Management. At a minimum, an outgoing trust must be set up so that the Exchange forest trusts the accounts forest.

For more information, see "Learn more about setting up a forest trust to support linked mailboxes" at http://technet.microsoft.com/library/ms.exch.eac.trustedforestordomainlearnmore(v=exchg.150).aspx.

Active Roles deployment

Active Roles deployment

The following Active Roles components must be installed in your Active Directory environment:

• Administration Service
• Web Interface
• Active Roles console

You can install these components on member servers in an accounts forest or in the Exchange forest. For installation instructions, see the Active Roles Quick Start Guide.

Log on as ARS Admin

Log on as Active Roles Admin

To configure Exchange Resource Forest Management, log on as Active Roles Admin. This ensures that you have sufficient rights to make the necessary configuration changes. Assuming the default configuration of the Active Roles Administration Service, you should log on with a domain user account that is a member of the Administrators group on the computer running the Administration Service.

Register domains with Active Roles

Register domains with Active Roles

Exchange Resource Forest Management requires the following domains to be registered with Active Roles:

• In the Exchange forest, a domain that hold computers running the Mailbox server role
• In each accounts forest, the domains that hold the users you want to administer with Active Roles

When registering a domain, you are prompted to choose which account you want the Administration Service to use to access the domain. You can either specify a so-called override account or let the Administration Service use its service account. With either option, the account must have sufficient rights in the domain you are registering. At a minimum, the account must have the following rights:

• Member of the Account Operators domain security group
• In case of Exchange 2010 or 2013, member of the Recipient Management role group in the Exchange forest (see “Access to Exchange Server/Exchange 2010” or “Access to Exchange Server/Exchange 2013” in the Active Roles Quick Start Guide), and enabled for remote Exchange Management Shell (see “Support for remote Exchange Management Shell” in the Active Roles Quick Start Guide)
• In the Exchange forest, read access to Exchange configuration data (see “Permission to read Exchange configuration data” in the Active Roles Quick Start Guide).

For instructions on how to register domains with Active Roles, see “Adding and removing managed domains” in the Active Roles Administrator Guide.