Transition from Single Forest to Cross-Forest: User account and mailbox movement from one forest to another forest: Part-4

Brief summary:
 In the past 3 articles, I have given the information regarding different transition scenario, showed you the prerequisite for single to cross forest transition, installation of exchange 2007 service pack1 & configuring IIFP for gal synch.

For more information for the above 3 articles please click on the below link:
Transition from Single Forest to Cross-Forest: Brief Introduction how to go with transition process : Part-1

Transition from Single Forest to Cross-Forest: Installation of Exchange 2007 Service Pack 1 : Part-2

Transition from Single Forest to Cross-Forest: Configuring Identity Integration Feature Pack : Part-3

 
In this session we will look into the different possible situation of moving user account and mailbox to exchange 2007.

Introduction to ADMT (Active Directory Migration Tool) :

 Active Directory Migration Tool (ADMT) is tool which will allow you to migrate users, computers and groups between the forest and domains and most of our exchange administrator are already knows about the importance of this tool.
  It has to run from MMC console by clicking Administrative e tools and then we need to right click ADMT and select appropriate options like User Account Migration Wizard, Group Account Migration wizard, Computer Migration Wizard as on.
  One of the interesting part regarding ADMT is after the release of ADMTv2 we got one more added feature called as migrating the passwords. These will really a good feature when we want to keep the same password. The most import part, I would like to talk regarding ADMT is migrating the account with sid history. Sid history holds security identifier (SID) information of the original account. If we are talking about exchange application and need to migrate a user from one forest to another forest it plays a vital role in these aspects, because it finds a match in AD based on the SID history stamped on the migrated account. If there was no SID history on the destination forest account it will create a disabled user account. I know most of the administrator have gone through this phase where disabled user account create and that time it will be really mess for us, so either we delete and recreate migrate the user account with SID migration option or else run ADclean tool (one of my favorite tool)
  The above information is just a basic regarding the ADMT tool. For more information please click on this link
 Introduction to Active Directory Migration Tool v2 for Administrators
 Latest version of ADMT tool v3.0
 
Click on this to download ADMT tool

Move Mailbox between the forests:
  Moving the mailbox between two different organizations is not a big deal if we understand the basic concept very well. Before we move the mailbox it is very important to take proper precaution.
Note: For moving the mailbox to exchange 2007 you can’t use Exchange Management Console instead of that you need to use Exchange Powershell only.

You can use the powershell command to move mailboxes in the following scenarios:
• Moving from an Exchange 2007 server in one forest to an Exchange 2007 server in another forest.
• Moving from a server running Exchange Server 2003 in one forest to an Exchange 2007 server in another forest.
• Moving from an Exchange 2007 server in one forest to an Exchange 2003 server in another forest.
• Moving from an Exchange 2000 server in one forest to an Exchange 2007 server in another forest.

Permission required for moving the mailbox:
The account you use for the source forest must be delegated the following:
• Exchange Recipient Administrator role for the source Exchange organization
• Exchange Server Administrator role and local Administrators group for the source server

How do we set the permission for source Exchange Organization:
 Open Exchange Powershell command
 Type the following command : $SourceCredential = Get-Credential
 Now it will popup the login window, as I have installed exchange 2003 by using administrator so will give his credential for access the source information
Figure 1:


The account you use for the target forest must be delegated the following:
• Exchange Recipient Administrator role for the target Exchange organization
• Exchange Server Administrator role and local Administrators group for the target server
The account you use to run the command must be delegated the Exchange Server Administrator role on the server where you run the command.

How to set permission for target exchange organization:
It is as same like source credential but the only thing we will do is : we will type the following command
$TargetCredential = Get-Credential in the powershell
Figure 2:


After giving the credential we have to use the following command for moving the mailbox
Move-Mailbox -TargetDatabase "E2K7\First Storage Group\Mailbox Database" -Identity Test -GlobalCatalog e2k7.happy.com -SourceForestGlobalCatalog e2k3.smile.com -NTAccountOU "OU=Test,OU=Happy,OU=Galsync,DC=happy,DC=com" -SourceForestCredential $SourceCredential -TargetForestCredential $TargetCredential

My Target Database : Exchange 2007 which is residing in happy.com
Identity : It is alias name of the source mailbox which I need to move
Global Catalog : Exchange 2007 forest GC
Source Forest Global Catalog : Exchange 2003 forest GC
NTAccountOU : This is container where you want to move the user account information.

Let me explain you what is happening in the background when you move the mailbox
1) Open Server Connections
Connect to the source and target server - checks if credential and server version is valid
2) Gather Source Information
Read source User Mailbox attributes
Check if source mailbox is a system mailbox (Fail if it is)
Check if source user does not have a mailbox (Fail if it does not)
3) Gather Target information
Check mailbox size limit against target database limits
Check if we can match the source NT account in the target Forest (account match based on SMTP address, source objectSID and target sidHistory, and legacyExchangeDN). If match is found, this account will be email enabled.
Check if target mailbox exists (used to determine if merge is needed)
Check if source mailbox is a resource mailbox (If it is the target user must be disabled)
4) Update Directory Information before Move
Lock access to source mailbox
Create the target mailbox
Lock target mailbox
5) Move Mailbox Content
Move the mailbox content
6) Update Directory Information after Move
Update mailbox location attributes on source and target user accounts
Unlock target mailbox

Let see how it works:
My Scenario:
                    Domain 1 : smile.com
                                                        Host name : e2k3.smile.com
                                                        Role : Exchange 2003\AD\DNS
    
                    Domain 2: Happy.com
                                                        Host name : E2k7.happy.com
                                                        Role : Exchange 2007\AD\DNS

Created a OU called as Test on both the domains and created few test users only in smile.com.
See this below figure 3:
Smile.com Domain Structure:


Happy Domain structure - Figure 3.1:


Now I will show some possible scenario and their effect:
I have installed ADMTv3.0 on both the AD servers (testing purpose) but I would prefer you to install it on the source server or else in target server. In target server you should have the access rights for source administrator when you are migrating sid history otherwise it will give you access denied. That’s why I preferred to move the user account by ADMT which is installed on my source server.
Path of the ADMT file : C:\windows\ADMT

Ok now let’s concentrate on moving the user account between the forests.
I am moving the user account from smile.com to happy.com.

Scenario 1:
  Installed ADMTv3.0 on Happy.com domain
  Running ADMT tool just to move the user account and then I will move the mailbox. Eg: I took the user account called as Test1 (user Account)
Figure 4:


Figure 4.1 : Welcome screen

 
Figure 4.2 : Domain Selection:

Figure 4.3 : User select Option:

Figure 4.4 : User Selection:

Figure 4.5 : Target domain OU

Figure 4.6 : Password Options:
 

Figure 4.7 : Account Transition Options:
 

Note if you select Migrate user SID’s to target domain it will give you an error message if you don’t have appropriate rights:

So it’s better to use source administrator account to run this tool.
But as we are going through some scenario I have unchecked sid migration and clicked next

Figure 4.9 : User options:

Figure 4.10 : Object Property Exclusion: Here you can exclude specific object properties if required

Figure 4.11 : Conflict Management:
 

Figure 4.12 : Completion the user account summary details:
 

Figure 4.13 : Migration Process



Tips: For checking log process you can either go to C:\WINDOWS\ADMT\Logs or click on view logs button

Note: if you see the above logs you will see one option called Errors and it is clear indication that user account which I have moved is having some error.
Reason: Could not disable or expire source account.  Access is denied. (Because I am running this tool from happy.com and Administrator is from Happy.com

Now I am going to run move-mailbox command

Set the logging credential for both source and target domain $SourceCredential = Get-Credential & $TargetCredential = Get-Credential from the powershell
Moved the mailbox by running move mailbox command from the powershell


Output:
Figure 15:


If you see the above figure : ADMT moved the Test1 account plus a DL Testusers and in the Testusers DL you will see only one member : Test1

When I started to move the mailbox from source to destination it has created a disabled user account for that mailbox as it is not able to find sid value.

Now let me show you the Exchange management console Figure 6:


Based on the above figure you can see that Test1 is created as Linked Mailbox.

Scenario 2:
  I will create a user account called as Test2 and then I will move the mailbox of Test2 from source to target.

Output:
 Same output as like what we had in scenario 1, Figure 7:



Scenario 3:
  I am going to run ADMT tool from Source server i.e E2k3.smile.com and while migrating the user account I will choose SID migration option and enable the user account in the target domain. Then I will move the mailbox from powershell.

Output:
Figure 8:


You can see that there is only user account for test3 and also it has built the mailbox.
 
In the Exchange management console: Figure 9


It has created as User mailbox.

ADClean Utilty (when to use this tool)
One more thing I would like add based on my experience with exchange 2003. There will be a situation where you will come across with scenario 1 and scenario 2 in Exchange 2003 or 2007 transition between the forests. In this situation we can use ADclean utility of exchange 2003. Let me show the steps. In this example I am using the Test 1 account and disabled account Test11 which I need to merge.
Copy the ADclean.exe and dsclean.dll from Exchange 2003 bin directory to C root drive of Exchange 2007.

Then run adclean.exe
Welcome Screen click on next (Figure 10)


Identify Merging Account Figure 11


In the above screen I have selected the OU of merging account

Reviewing Merging Accounts Figure 12

Need to select source account and target account for merging them both.

Begin Merging Accounts Figure 13


Then it will do merging process Figure 14:




Output :
Figure 15


In the above figure you can see that Test user account has been merged with test disabled user account and now i have only one user account for my mailbox

Once you move the mailboxes to target domain then you can safely uninstall the Exchange 2003 from source domain.

I hope this article is being very informative for you all to understand how the transition from single forest to cross forest.

Related Article:

Transition from Single Forest to Cross-Forest: Brief Introduction how to go with transition process : Part-1

Transition from Single Forest to Cross-Forest: Installation of Exchange 2007 Service Pack 1 : Part-2

Transition from Single Forest to Cross-Forest: Configuring Identity Integration Feature Pack : Part-3

Reference:

How to Transition from Single Forest to Cross-Forest

Thanks to:
I would like to thanks to Mr.Harjinder Singh (v-9harsi) who had helped me by giving some hints for configuring the IIFP and it won't possible me unless and until he clarified certain confusion which was running in my mind, thank harji for spending bit time with me during this lab setup.
Subin John one of my good trainer who helped me to understand the basic concept of ADMT function and made me capable of working in Exchange enviroment.
Rodney R. Fournier who had very well explained the configuration of IIFP in his website : Identity Integration Feature Pack (IIFP) - GalSync unleashed. Because without his article I won't come to know what is the basic rights i need to give.
Microsoft for publishing the information regarding this environment setup.
And last but not least v-9groups and all the viewers who have spend their time to go through these articles.

If anybody feel to add comment they are most welcome.