Connecting Exchange Server 5.5 to Active Directory

Installing the Active Directory Connector

As stated previously, because Exchange Server 5.5 was designed to run in the non-directory Windows NT 4 environment, it has its own directory and no way of communicating with Active Directory. To solve this problem, Microsoft introduced the Active Directory Connector (ADC). Three versions of the ADC exist: the Windows 2000 Server version, the Exchange 2000 Server version, and the Exchange Server 2003 version. (In this chapter, the focus is on the Exchange Server 2003 version of the ADC.) The Windows 2000 Server version was limited in its functionality in that it could only synchronize the Site Naming context. While the ADC could synchronize account information between Exchange Server 5.5 and Active Directory, it could not synchronize the Configuration Naming context. As a result, it could not be used if you installed Exchange 2000 Server into an Exchange Server 5.5 organization.

The Exchange 2000 Server version of the ADC was more full-featured than the Windows 2000 Server version and allowed full connectivity between Active Directory and Exchange Server 5.5, but in the real world, it was cumbersome to work with since everything had to be configured manually. The Exchange Server 2003 version of the ADC improves on the Exchange 2000 Server version and offers a number of configuration wizards that help an administrator to configure ADC properties. Even though the wizards greatly simplify deployment of the ADC, it is still useful to be able to configure connection agreements and other settings manually.

A connection agreement defines one- or two-way communication between data sources. In this chapter, the emphasis in on the connection of the Exchange Server 5.5 directory with Active Directory. In this context, a connection agreement describes how information, such as mailboxes in an Exchange Server 5.5 organization, is replicated into Active Directory user accounts and vice versa.

Planning for an ADC Deployment

The ADC is implemented as a service in your Active Directory domain. Placement of the ADC is an important consideration because it can be a resource-intensive service. Generally, you will want to install the ADC on a member server in the same site as the server running Exchange Server 5.5. You don’t want the server running the ADC and the server running Exchange Server 5.5 that is synchronizing with the ADC to be separated by slow bandwidth, if at all possible. Slow bandwidth is typically associated with wide area network (WAN) connections but can be viewed as anything less than 10 mega bits per second (Mbps).

The ADC uses an Active Directory global catalog server in a multidomain environment, so when configuring connection agreements after the installation, you should use an Active Directory domain controller that is a global catalog, preferably, or otherwise is on the same subnet as a global catalog.

There can be only a single instance of the ADC service on a given server, but you can install the ADC service on multiple servers in a domain if necessary (such as for redundancy). If you have multiple domains, you will need to install at least one instance of the ADC service in each domain. However, you can install as many instances of the ADC Management components as necessary to administer the organization.

ADC Installation

The account you use to install the ADC must be a member of the Schema Admins and the Enterprise Admins groups. In smaller Active Directory structures, there usually isn’t a concern in using the domain Administrator account, but in large enterprise environments, the Administrator account in a given domain may not also be a member of the Schema Admins or the Enterprise Admins groups. This is because only the Administrator account in the forest root domain is a member of these groups by default. If you have child domains or additional domain trees in the forest, the Administrator account for those domains will not be a member of these groups by default.

You should run ForestPrep and DomainPrep prior to installing the ADC. The ADC Setup Wizard does extend the schema if it detects that ForestPrep has not been previously run, but you will run into problems later when configuring connection agreements if you have not run DomainPrep because the Setup Wizard creates two domain local groups: Exchange Services and Exchange Administrators.

Subsequent installations of the ADC in the same forest do not configure the Active Directory schema or create domain objects, so when performing subsequent installations, only Enterprise Admins membership is required of the installation account.

You will install the ADC as part of the practice at the end of this lesson.

Using the ADC Tools

Once you finish installing the ADC, you can configure it to synchronize between Active Directory and the Exchange Server 5.5 directory. You do this through the Active Directory Connector Services management console, which is accessed through the Start menu, in the Microsoft Exchange program menu. After starting the console, there are two options: Active Directory Connector (servername) and ADC Tools. The first option allows you to configure ADC connection agreements and settings manually. The second option, ADC Tools, provides configuration assistance through a series of wizards. Figure 1 shows the ADC Tools page.

Using ADC Tools is a four-step process:

After finishing the configuration process with ADC Tools, you can test directory synchronization by creating a new mailbox in Exchange Administrator and choosing the option to Create A New Windows NT Account. After you create the mailbox, you should see the new user account in the Active Directory Users And Computers console.

Setting Up a Connection Agreement Manually

While using ADC Tools is usually sufficient for configuring directory synchronization, there are times when you will want to configure connection agreements manually, especially in complex Exchange environments involving multiple sites. The Active Directory Connector Services console is used for configuring connection agreements manually.

The environment into which you are deploying the ADC will dictate how you set up your connection agreement. For example, if you need mailboxes to be created automatically in Exchange Server 2003 for users created using the Active Directory Users And Computers console, you will have to replicate data from Windows to Exchange. Likewise, if you want the Active Directory user account to be deleted automatically when the associated mailbox is deleted, you must replicate data from Exchange to Active Directory.

When you begin to create a connection agreement manually, you should have a design plan in mind regarding what the connection agreement intends to accomplish and what servers will be involved. In a small organization, you may have only a single Exchange Server 5.5 server and a couple of domain controllers, which simplifies the configuration process. However, in a large organization, you have to plan more carefully. For example, when you create a new connection agreement, you must define a server that will manage the connection agreement. This can be any server in the organization that is running the ADC service. You must also choose whether directory replication will occur in one direction or whether there will be two-way replication back and forth between Active Directory and the Exchange Server directory.

In addition, you must also configure whether the connection agreement is the primary connection agreement for both the Windows domain and the Exchange organization. If this is the only connection agreement, configuration is simple because it will, of course, be the primary connection agreement for both. However, if you have multiple connection agreements that are replicating account and mailbox data, it is important that only one of them is configured as the primary connection agreement. The reason for this is that the primary connection agreement will take precedence when a conflict occurs in replication. If multiple primary connection agreements exist, you could easily end up with duplicate objects being created. The default configuration, on the Advanced tab of the connection agreement’s properties, enables the connection as a primary connection agreement for both the Windows domain and the Exchange organization. You must clear the check boxes on the Advanced tab if you do not want the connection agreement enabled as the primary connection agreement.

Connection agreements are not limited only to intra-organization. You have the option to designate a connection agreement as an inter-organization connection agreement, which replicates data between an Exchange Server 5.5 organization and an Active Directory domain that contains a different organization. This is also configured on the Advanced tab of the connection agreement.

Two-way replication would be problematic if it simply began in both directions at once. As a result, the connection agreement defines which direction should begin replication. The default, set on the Advanced tab of the connection agreement’s properties, is for replication to begin by synchronizing data from Exchange to Active Directory. This behavior can be changed by selecting From Windows from the drop-down list.

You can also delete connection agreements using the Active Directory Connector Services console. In fact, you must delete existing connection agreements prior to uninstalling the ADC. Deleting a connection agreement is a simple process. Right-click the connection agreement that you want to delete, and then click Delete from the context menu.

Replication occurs regularly according to the schedule configured for the connection agreement. However, there might be times when you want to replicate changes immediately and do not want to wait for the scheduled time or to reconfigure the schedule. You can initiate a manual replication on a connection agreement at any time by right-clicking the connection agreement in the Active Directory Connector Services console, and then clicking Replicate Now.

Practice: Connecting Exchange Server 5.5 to Active Directory

In this practice, you will create a number of Active Directory user accounts and Exchange Server 5.5 mailboxes. Once you install the ADC and use ADC Tools to configure directory synchronization, you will be able to see the effects of your configuration on the accounts and mailboxes by testing the configuration of your connection agreement. This will ensure synchronization is taking place.

This practice will use Server01 as outlined at the beginning of the chapter. Create the following Active Directory user accounts, and then create mailboxes in Exchange Server 5.5 and associate the mailboxes with the user accounts:

• Jenny Lysaker

• Bob Gage

• Nicole Holliday

• Amy Alberts

• Angela Barbariol

• Eli Bowen

• James Peters

• Karen Berge

• Jonathan Haas

• Mark Hassall

• Raymond Sam

• Sean Purcell

In addition, create the following security groups in Active Directory (you do not need to add users to the groups):

• MIS

• Marketing

• Sales

• Executive

Finally, create a mailbox named MIS in Exchange Server 5.5 and associate it with Nicole Holliday’s user account. Create a mailbox named Executive and associate it with Mark Hassall’s user account. Create mailboxes for Marketing and Sales and associate them with their respective Active Directory security groups. Create a user account for Nicole Carol, but do not create a mailbox for it.

Exercise 1: Install the ADC

Exercise 2: Prepare Exchange Server 5.5 for Directory Synchronization

Exercise 3: Verify Directory Synchronization