Skype for Business Server forest mode
The Master Account Management policy is intended for multi-forest environments where the Skype for Business Server forest is used either as a resource forest or as a central forest. In the central forest mode, the Skype for Business Server forest may hold logon-enabled Skype for Business Server user accounts in addition to shadow accounts (contacts) for Skype for Business Server users from external forests. In the resource forest mode, the Skype for Business Server forest holds only shadow accounts (logon-disabled user accounts) for Skype for Business Server users from external forests. The Forest Mode policy setting allows you to choose the option that matches the Skype for Business Server forest mode in your Skype for Business Server deployment:
- Resource forest The policy creates and administers logon-disabled user accounts as shadow accounts for Skype for Business Server users from external forests. The user account from an external forest, referred to as a master account, is linked and synchronized with the shadow account that is enabled for Skype for Business Server in the Skype for Business Server forest.
- Central forest The policy creates and administers contact objects as shadow accounts for Skype for Business Server users from external forests. The user account from an external forest, referred to as a master account, is linked and synchronizes with the contact that is enabled for Skype for Business Server in the Skype for Business Server forest.
Container for new shadow accounts
The Master Account Management policy allows you to specify the container in which you want Active Roles to create shadow accounts when enabling master accounts for Skype for Business Server. You can select the desired organizational unit in the Skype for Business Server forest or you can let Active Roles choose the default container.
If you select a particular organizational unit, Active Roles creates shadow accounts in that organizational unit. You can select an organizational unit from any domain of the Skype for Business Server forest that is registered with Active Roles as a managed domain.
If you let Active Roles choose the default container for new shadow aActive Rolesccounts, then Active Roles creates shadow accounts in the Users container in a particular domain of the Skype for Business Server forest. If the forest root domain of the Skype for Business Server forest is registered with Active Roles as a managed domain, then Active Roles creates shadow accounts in that domain. Otherwise, Active Roles creates shadow accounts in the domain that appears first in the ordered list of the managed domains from the Skype for Business Server forest. Note that Active Roles requires at least one domain of the Skype for Business Server forest to be registered with Active Roles as a managed domain.
Default description for new shadow accounts
The Master Account Management policy allows you to specify a text to use as the default description for new shadow accounts that Active Roles creates when enabling master accounts for Skype for Business Server. Active Roles writes that text to the Description property of every new shadow account.
Attribute to store a reference to shadow account
By default, the Master Account Management policy designates the adminDescription attribute of the master account for storing the GUID of the shadow account, and allows you to choose a different attribute for that purpose. Skype for Business Server User Management uses this attribute to identify the shadow account in the Skype for Business Server forest when managing a given master account in an external forest. The policy causes Active Roles to set this attribute on the master account when linking the master account to the shadow account in the Skype for Business Server forest.
