Intra-Forest Migration and Office 365 - Notes from the Field - Part 2

So in our previous post we talked about some high level problem statements, Business Requirements and some key design goals and decisions which need to be understood and discussed to allow a successful migration to a more Supportable Directory and Messaging Infrastructure. 

Here we will start to look at how we looked to achieve each of these goals in the key technology areas.

Design Goal - A more Simple and Consolidated Directory Platform
Design Decision - To migrate all users, Computers, Servers, Groups to the root domain and collapse each child domain. 

So to achieve the migration we decided upon the Using Dell (Formerly Quest) Migration Manager for Active Directory. I will not be covering on how to use Quest Migration Manager, This blog assumes that you or your IT Partner is well versed in the product.

Planning
Its all in the planning !. This is so true. A good time spent on planning and understanding the environment is "key" to a successful migration.  So here is some key elements that we needed to ensure were covered before we started.

We will be going through an intra-forest migration.  This term is used when users and groups are migrated from one domain to another domain in the same Active Directory forest. As such there are some key considerations that must be taken into account for such a migration. Some key points can be referenced here:

https://support.software.dell.com/migration-manager-for-ad/kb/32273 

• invalid characters and Duplicates (SAMAccount, UPN, Alias) 
• Office 365 and other cloud services have some very strict requirements on supported characters that are used in key attributes, in our case these where the SamAccountName,UPN (User Principal Name) and Exchange Alias Names (Users, Groups etc..). A good start to understand in more detail is here:
• Also Duplicate Entries across multiple domains is always a challenge, but knowing these upfront will allow for better planning on how these are handled.

A good place to start is to run the IDFIX tool (In read only to start with) so that you can ascertain domain specific issues. In our case we wanted to run across multiple domains to capture samaccount duplicates, so in this case we also used Quest Reporter which is a great tool to use for anything AD related. (Inactive accounts, empty groups,service accounts and much much more). 


So once we have looked to complete all of our planning we were good to go and start to pre-stage users and groups (Minus exchange attributes, This will become clearer once we talk-bout DirSync and Office 365) 
As alluded to earlier we identified an issue (through the planning stages) where the UPN and SamAccount names where not supportable with office 365. So to ensure we complied we needed to rename all active directory usernames from "firstname (Space) lastname".

Alas this sounds worse than it seems, as because we wanted to align the UPN with the E-mail Address which was First.Last we are able to use Dell (Quest) Migration Manager by using Import files to rename these upon migration, we just needed to export the old users "mail attribute"  and with a bit of excel and notepad we were able to quickly create the required import files.

So at this point we have per-migrated all user accounts and Groups and is Synchronising Group memberships and All Attributes. (Minus samaccount and UPN as this was changed during migration so you need to ensure this is added as an exception during Directory Sync).

A couple of key points you may also need to be aware of is:

• Cross Domain Membership
• You will need to run the ADPW to add target objects into other Active Directory Domains in the Forest in cross domain membership is in use.
• Distribution Groups - Similar to above process, When you migrate the users exchange attributes,You will need to run the ADPW to add the Target accounts back into the source Distribution Groups. (As this will still hold the Exchange Attributes)
• Exchange Attributes
• We will plan to move the exchange attributes during the mailbox migration to Office 365.

OK, That`s all for this one folks. Some food for thought I hope. next time we will talk a little around how we handled Administration Delegation and some obstacles and gotchas`s that we encountered.




 

Outlook 2013 / 2016 Windows 8 / 10 Desktop Alerts not allowing to Delete or Flag

Issue
A very handy feature of previous versions of Outlook was to Delete and flag e-mail messages  based upon the sender and a small snippet of information of the e-mail within the desktop Alert.
Alas, If you run windows 8 and Outlook 2013 you are subject to the Basic Windows 8 Notifications where you can click to read the mail, and that is It ! not the best when you know the mail is Junk and just want rid !.

Solution
Fear Not, There is a quick and handy workaround to bring the feature back.  Simply make Outlook (C:\Program Files\Microsoft Office 15\root\office15\outlook.exe), (may be different for x86)  run in Windows Vista Compatibility Mode. Simply Right click, properties, Compatibility, Select run in Windows Vista (Service Pack 2) mode.

Close and Re-open outlook and all is Good. Welcome Back Desktop Alert !

Intra-Forest Migration and Office 365 - Notes from the Field - Part 1

Introduction
The purpose of this series of blogs is to share a "real-life" migration experience in which a multitude of technologies were used to provide the required solution and the toolsets used to allow us to make that journey. In Part 1 we will look at where we started and where we need to get to. During the series will look into greater detail at each key stage which will discuss Pit falls, quick wins and "known issues"

 Problem Statement
Customer A has a large number of Subsidiary  Businesses compromising several thousand of employees. With a highly de-centralised IT operations model with each business being autonomous for its own domain. The IT Estate was also aging with little or no support. There was also a large amount of unmanaged Messaging data in the form of PST files because of highly restrictive storage limitations.

Business Requirements
The desired end state was to create a much more Simple and Manageable IT solution with each Business still requiring a degree of  autonomous administration. The solution must also provide enhanced collaboration and communications.

Current Environment
The current topology was a Single Active Directory forest (Windows 2003) compromising a number of Child domains with an Exchange Organisation across the forest and each domain. (Exchange 2003)

Design Goals and Decisions

Design Goal - A more Simple and Consolidated Directory Platform
Design Decision - was to migrate all users, Computers, Servers, Groups to the root domain and collapse each child domain.
Dell (Formerly Quest) Migration Manager for Active Directory was the chosen tool. Part 2 will discuss important preparation tasks and considerations that are needed before we start an Intra-Forest Migration.

Design Goal - Autonomous Admin
Design Decision - Each Business Unit has its own Organisational Unit with delegated administration with only the required rights.

Design Goal - Replace the Aging, Unstable and Limited Exchange 2003 Platform
Design Decision - Office 365 was chosen to provide the Communication, Collaboration and Messaging Platform (Exchange, Lync, SharePoint & Yammer) . MobileIron Cloud provided continuous support from the legacy environment to Office 365. Check out Part 2 on how we planned and executed the co-existence and migration to Office 365.

Design Goal - Manage Legacy Archive and all future messaging data.
Design Decision - Symantec EV.Cloud was chosen to provide all mail arching and legacy pst management.

Design Goal - Keeping it Simple. Users must only require a Single User Name and Password to access all platforms.
Design Decision - ADFS and Dirsync was implemented to provide SSO (Single Sign On) for Office 365 and Symantec EV.Cloud **(Check out later posts for some "Known" limitations/features of SSO.

Design Goal - No Single Points of Failure
Design Decision - Office 365 and Symantec by design offers this technology by default. To match the resilience within the on-promised ADFS Design. The solution was dispersed across multiple datacentres and servers. We will cover this in more detail later in the series.
 
So we have our challenge, Some key design decisions. In part 2 we will look start to look at each stage and Identify how we get there and highlight some important processes and considerations that need to be understood.

Lync Server 2010 - Add / Enable users in a Security group

The Challenge
In large complex Active directory's, there tends to be a challenge when targeting certain users across many OU`s. This article describes the process to enable users based on membership of certain groups.

Resolution
From Lync Powershell simply user the -Filter option as per below, changing the required text to match your needs.

Get-CsAdUser -LDAPFilter memberof=cn="MySecurityGroup,ou=mylowestou,ou=myou1,dc=mydomain,dc=co,dc=uk" | Enable-CsUser -RegistrarPool mylyncpool.mydomain.co.uk -SipAddressType EmailAddress

Lync Server 2010 - Install Fails server.msi Error code 1603

Issue
Whilst trying to Install Lync 2010 Server components the Install mail fail during and the following message is logged:
Error returned while installing Server.msi(RegistrarStore), code 1603

Cause
This may occur if the Admin$ Shares have been removed from the local server or SQL server (C$, D$)

Resolution
Re-create the admin shares on the server that the Intstall fails.

Exchange 2010 - Outlook 2010 Personal Archive not visible

Symptom
After enabling a user for a personal archive, the archive does not show through outlook 2007 or 2010 but can be accessed via Outlook Web Access (OWA)

Resolution
Something that is not clearly stated on Technet is that only certain versions of Outlook / Office 2010 are supported with Exchange 2010 Personal Archive.
REF:
http://office.microsoft.com/en-us/outlook-help/license-requirements-for-personal-archive-and-retention-policies-HA102576659.aspx?CTT=5&origin=HA101830421

Outlook retail licenses

Supported	Not supported
Outlook 2010 stand-alone Outlook 2007* stand-alone Outlook 2007* included with Microsoft Office Ultimate 2007	Outlook 2010 included with Microsoft Office Home and Business 2010 Outlook 2010 included with Microsoft Office Professional 2010

Outlook volume licenses

These licenses are available through volume licensing only. For more information, see Microsoft Volume Licensing Programs.

Supported	Not supported
Outlook 2010 stand-alone Outlook 2010 included with Microsoft Office Professional Plus 2010 Outlook 20071 stand-alone Outlook 20071 included with Microsoft Office Professional Plus 2007 Outlook 20071 included with Microsoft Office Enterprise 2007	Outlook 2010 included with Microsoft Office 2010 Standard2 Outlook 2007 included with Microsoft Office 2007

Mailtips / OOf

Simple little tip. This is one for the times you scratch your head after configuring EWS with what seems like a simple URL change (eg https://mail.consultantsrus.co.uk/ews/exchange.asmx). You are sure it is correct, and you have done an IISRESET on all your CAS servers. But still when you connect via Outlook Anywhere you get the annoying "Mailtips cannot be retrieved" on a new message, and the Out of Office cannot be set with the "server is not available" warning.

Go back into IIS and recycle the Autodiscover app pool ! Voila ! Simples  :-)

Hope this helps