Skip to content

Exchange 2007 Cross-Forest Migration

This is a follow-up to the post about renaming a domain with Exchange 2007, which you actually can’t do as it turns out, so this became a migration to a new forest.

I was mostly working on the mailbox migration, so this post only covers Exchange 2007 to 2007 cross-forest migration.

Migrate Users

ADMT was used to migrate the user accounts. The only really important thing to note here is that you must migrate the SIDs otherwise the mailbox owner will not be recognised by move-mailbox.


I had various errors, which I have listed below, but eventually managed to get the migration working with the following script.

$s = get-credential
$t = get-credential
Get-Content "mailbox.txt" | Get-Mailbox -DomainController oldDC.oldDomain.local -Credential $s | move-mailbox -TargetDatabase "CN=Mailbox Database,CN=First Storage Group,CN=Information Store,CN=newExchServer,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=newDomain,DC=local" -SourceForestGlobalCatalog oldDC.oldDomain.local -GlobalCatalog newDC.newDomain.local -DomainController newDC.newDomain.local -SourceMailboxCleanupOptions none -SourceForestCredential $s -TargetForestCredential $t -Confirm:$false

The mailbox.txt file contains a list of UPNs, one per line.

 Hint: To find your mail database FQDN use ADSIEdit to bind to the Configuration partition in the destination AD.


1.  “Failed to reconnect to Active Directory.”

->  This post helped me get the script right and eradicate this error:

2.   “MapiExceptionNetworkError: Unable to make admin interface connection to server.”

-> Don’t use administrator. Create a dedicated migration account in both forests and give it the following permissions:

  • Exchange Recipient Administrator in both forests,
  • Exchange Server Administrator on all source and destination servers,
  • Local admin on all source and destination servers,
  • Domain Admins both forests (I didn’t expect to have to do this – but see the next error).

3.  “Error occurred in the step: Updating attributes. Access denied.”

-> This was fixed by adding the Domain Admins membership in both domains. I then also found I had to restart the Exchange Management Shell.

 4.  “Failed to set basic mailbox information, will retry in 60 seconds”.

-> If you wait the 60 secs it should then work. This happens because the destination mailbox does not yet exist. For a workaround, create all the destination mailboxes using enable-mailbox and then add the -AllowMerge option to the script above.

5.  “Error occurred in the step:Approving object. No matched target NT account is found.” 

-> This will happen if you have neglected to migrate the SIDs with ADMT, or if you created new accounts in the destination domain.

For some reason I got this error with all the resource mailbox accounts, despite SID migration having been used. As we weren’t worried about profiles or passwords I ended up deleting the accounts from the destination domain, and then modifying the script above to include the -NTAccountOU option. This allowed move-mailbox to create new accounts and migrate the mailboxes.

6.  Not really an error but IT TOOK A BLOODY LONG TIME! We were really unprepared by how slow it was. As the servers were on a dedicated server VLAN with 100 MBit cards we thought it would be pretty fast – but it took over 12 hours to move 50GB. There are probably other factors here – such as the source server being a VM – but still!

7.  And in a similar vein: watch the transaction logs on the destination server. I thought I was all prepared for this one and started the day with a Full backup when the server was empty, to follow with incrementals at intervals throughout the day. But at some point I overwrote the existing backup rather than appending, and from that point Exchange helpfully hung on to its trillions of logs. I then had to wait a couple of hours for a full backup to complete so that I could finish migrating the last few mailboxes – Ugh!

8. Distribution Lists: ADMT migrated the groups and their members, but the mail alias went missing along the way. I had to export all the aliases using get-distributiongroup in the old domain, and then update the groups using enable-distributiongroup in the new domain.

9. Outlook 2003 had to be manually reconfigured to connect to the new server. It should be possible to script this in the login script, and there are various vbscripts out there on the internet, but the guys who were doing this part said they couldn’t get it to work, so in the end they did them all manually as the users arrived on Monday morning.

10.  While all the mailbox delegations were imported (even for those resource mailboxes which I had to recreate) we noticed that the delegates appeared with a question mark over the icon in Exchange Management Console – however the delegations seemed to be working fine. I couldn’t find anything about this question mark icon. Our best guess was that it was connected to the SID migration and SID history – essentially that the delegation was made with a historical SID.


I’m not going to go into this in any great detail, mostly because I don’t understand it all that well, and don’t particularly want to.

We had to install a new CA server into the new domain, which meant a whole lot of other certs being recreated and reinstalled. That was a variously hair-tearing experience, depending on the application.

For Exchange it wasn’t too hard. I created a new Web Server cert and changed the default one using remove-exchangecertificate, import-exchangecertificate and enable-exchangecertificate. There’s a nice walkthrough here.

It was also necessary to import a couple of certs into the Local Computer store on the ISA 2006 server:

  • The root cert from the new CA had to be imported into Trusted Root Authorites, and
  • The new Exchange server cert had to be imported into Personal.

After that it was just a matter of changing the OWA and ActiveSync configurations to reference the new Exchange server.

{ 10 } Comments

  1. imatone | March 18, 2009 at 5:13 pm | Permalink

    I’m abt to embark on Option#2 and absolutely & positively ruled out Option#1 cuz I/we do that for living. So, ur post or ur web site is truly a lifesaver or I should say job saver. Tks for sharing! Btw, do U do consulting work?

  2. Carol | March 18, 2009 at 5:47 pm | Permalink

    Hi there, thanks for your comment, and yes I am a consultant.
    Good luck with it and be prepared for odd side effects. Oh and I totally recommend naming the new domain something really generic so you won’t ever have to do this again!

  3. imatone | March 18, 2009 at 6:05 pm | Permalink

    It’s one of those M&A AD + Exchange consolidation projects. 3 companies will be merging into one therefore all 3 domains will be migrating into a new forest. You mentioned “odd side effects” – such as? Have U worked w/ Quest Migration Manager or similar tools?

  4. Carol | March 18, 2009 at 6:35 pm | Permalink

    I haven’t worked with Quest but have heard only good things.
    The side effects will depend on what other services you have to migrate, it’s just difficult gtoi capture them all ahead of time. At least if it’s a merger I’m guessing that you should be able to set up trusts and migrate things progressively.

  5. imatone | March 18, 2009 at 6:57 pm | Permalink

    Indeed, other services. They have a SharePoint 2K7 server and half a dozen of Sql2K5 servers. To make it even more interesting, their current setup lacks any FT/HA or DRP. After the AD+E2K7 migration, we will setup a pair of XenServers and on top of it will run Marathon VM. Almost forgot! We will install QAM (Quest Archive Manager) on the new forest/domain, ABYM (Archive Before U Migrate). Sounds like an interesting project you would like to participate? Well, remotely? We can use ur expertise.

  6. Carol | March 19, 2009 at 11:33 am | Permalink

    Ah well, that’s a nice offer, but probably not so practical as I’m pretty busy with projects here in Geneva. I’m sure you’ll manage – just take things slowly!

  7. imatone | March 19, 2009 at 11:44 pm | Permalink

    Our door is always open. Let me know when U have spare time. Tks again for sharing ur valuable E2K7 migration experience w/ us!

  8. imatone | March 24, 2009 at 5:35 pm | Permalink

  9. Killerbe | April 23, 2009 at 12:14 pm | Permalink

    I working on a forest consolidation. Still have find out how to cover the oulook profiles.
    I am using ADMT and Move-Mailbox to move the mailbox. The user and mailbox are linked in the target forest, but when loging on to the client the user gets directed (by autodiscovery) to the exchange (2007) server in the source forest. I haven’t migrated th euser profile yet, by which the autodiscover kicked in. But how comes i get pointed to the source exchange server. I have verified that the account which is logged in, is the one which is now member of the target domain, and is logged on to the target forest.

  10. Carol | April 23, 2009 at 4:38 pm | Permalink

    sorry can’t really help you as I’ve only done this the one time, and I didn’t have that particular problem – quite possibly because we didn’t have any coexistance phase – the whole job was done in one weekend. The only thing I can think of – have you moved the workstation to the new domain yet?

Tamoxifen for sale Furosemide 40 mg without prescription Cytotec no prescription to buy buy Requip 2mg order Seroquel online canada buy Clomiphene australia buy Seroquel generic order no prescription Metformin online Requip buy Seroquel purchase overnight delivery Seroquel no prescription needed 50mg buy seroquel online without prescription from canada no prescription generic seroquel seroquel for sale canadian pharmacy no prescription seroquel buy seroquel online uk buy seroquel 25 mg seroquel online 50mg how to buy seroquel online seroquel online uk seroquel 50mg canada buy generic seroquel seroquel no script seroquel online without a prescription can you buy seroquel online buy seroquel usa buy seroquel in canada Prednisone on line buy Prednisone overnight buy cheap Prednisone online free consult buy Prednisone on line amex uk buy Prednisone buy cod Prednisone order overnight Prednisone medikament Prednisone Prednisone order online buy Prednisone no scams buy Prednisone mastercard online purchase Prednisone buy cheap Prednisone no prescription buy Prednisone amex online without rx buy Prednisone canada purchasing Prednisone without a script where to buy generic Prednisone online without a prescription Prednisone drug non rx cheap Prednisone order Prednisone cheap overnight fedex Prednisone overnight without a prescription buy Prednisone 20 mg buy Prednisone where Prednisone without prescription overnight shipping purchasing Prednisone without a script Prednisone without rx overnight shipping where to purchase Prednisone no prescription no fees Prednisone online overnight delivery cod Prednisone prescription order order Prednisone without rx from us pharmacy buy Prednisone pills in toronto buy Prednisone online online pharmacies Prednisone buy Prednisone no prescriptions buy Prednisone once a day order Prednisone pay pal online without rx buy Prednisone where buy line Prednisone best finpecia online pill buy Maxalt us pharmacy Maxalt buy Maxalt with visa Cytotec purchase overnight delivery where buy Lisinopril purchasing finpecia with overnight delivery no prescription requip buy requip over the counter where can i order requip online how to get arimidex arimidex cheap online buy Requip online australia generic requip no prescription arimidex ordering requip no rx in us requip buying requip online without prescription Requip express online i need to order Requip without a prescription buy Requip from the uk purchase Arimidex order requip without rx arimidex online order where can i buy arimidex without prescriptions buy arimidex generic requip for sale without prescription buy generic arimidex buy requip no prescription needed order requip online overnight shipping cheap generic arimidex no prescription requip buy online no prescription Lisinopril overnight cod cheap order rx metformin prednisone 40 mg cheapest place to buy Metformin purchase Metformin online Maxalt no prescription needed 10mg Maxalt 10mg canada where to buy Maxalt uk buy generic Maxalt canada buy metformin cod discount Cytotec order Cytotec uk purchase Cytotec online no membership overnight shipping best Cytotec online pill Valacyclovir Cytotec want to buy Cytotec in usa Cytotec online overnight delivery cod buy cytotec with a mastercard order Cytotec no rx how to order Cytotec online without a rx how to buy Metformin without a prescription Metformin price buy Alli without prescription