RE: [ActiveDir] 5.5 to 2K migration and A.D.

[Grillenmeier, Guido]

I'll take a quick shot at this - see inline   /Guido From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Stefano Crivellaro Sent: Freitag, 21. Mai 2004 09:08 To: [EMAIL PROTECTED] Subject: [ActiveDir] 5.5 to 2K migration and A.D. Hi all   I have read a lot of documentation on Excange 5.5 to Exchange 2000 migration, still I can find answers to some questions....   I want to migrate from 5.5 to 2K.   I have a Win2K domain already in Native mode. Users accounts are already in A.D..   I have three 5.5 servers, they belong to the same Exchange Organization and to the same Exchange Site (there is only 1 site).   All the three 5.5. servers are already installed on Win2k servers.   Of the three 5.5 servers one is at the main office and holds 70% of the mailboxes while the two other 5.5 servers are in two distant offices.   The 5.5 server at the two distant offices have their own local (on the same subnet) Win2k domain controller, Global Catalog, DNS, WINS.   As they all belong to the same site the replication mechanism among the servers is the RPC-based 5.5 replication mechanism.   I plan to migrate the main 5.5 server doing a "move mailbox" upgrade, which is installing an Exchange 2000 server at the main office and then move the mailboxes from the 5.5 to the 2k server.       Now I know that I have and install and configure the ADC and run NTDSAtrb to generate a file with the NTDSNoMatch in Field 10 etc.   What I was not able to find is the explanation of what happens in the mapping of information from 5.5 Directory to A.D. in these cases:   (Please note that all my user accounts are already in A.D.)   Case 1   Mailbox with alias A has PWNTA (Primary Windows NT Account) set to account A   Mailbox with alias B has PWNTA set to account A   also , in the Permissions tab for the mailbox A the accounts C and D have user level permissions on that mailbox and  in the Permissions tab for the mailbox B the accounts E and F have user level permissions on that mailbox.   How would this configuration in the 5.5 Directory be mapped onto the A.D. by the ADC?   Would account A lose access to mailbox B at the moment the ADC replicate for the first time the information in A.D. or after I move mailbox B to the Exch2k server? [Guido Grillenmeier] whichever mailbox gets mapped first by the ADC wins - the other will get a new placeholder account (depending on your ADC config). This could be either mbx A or B, since any AD object can only be mapped to a single mbx. You can still assign permissions to various other maiboxes, but not as the primary account.  => this is why you want to ensure, that every NT4 account is only the PWNTA of exactly that mailbox, which you want to have assigned to him in AD/E2k   What happens to the permissions of accounts C,D,E,F? Would they lose access to the mailboxes at the moment the ADC replicates for the first time or only after I move the mailboxes A and B to the Exchange 2k server? [Guido Grillenmeier] the permissions would still come accross ok and will also remain on the object when moved over to the E2k server   Case 2   Mailbox with alias A has PWNTA (Primary Windows NT Account) set to account B, in the Permissions tab for the mailbox A the accounts C and D have user level permissions on that mailbox   How would this configuration in the 5.5 Directory be mapped onto the A.D. by the ADC? [Guido Grillenmeier] the name of the alias doesn't matter, since you've already got your user-accounts in AD - the match will happen via the SID of the PWNTA.   So if B isn't assigned to another mailbox as well, this is a non-issue. And the permissions for C and D come over fine as well.   Note: even though the permissions granted on the mailbox object itself come accross well, the users may still have granted various permissions WITHIN their mailbox for access to calender or specifi mbx-folders => these will usually cause the main headaches when moving the mbx to the E2k server.  You'll be best to move your mailboxes in "closed sets" - i.e. all users that potentially share a mailbox (boss + secretary) should be moved to the E2K server at the same time (i.e. within the same batch at night).   Thank you very much for your help!   Stefano