Skip to content

Exchange 2007 Cross-Forest Migration

This is a follow-up to the post about renaming a domain with Exchange 2007, which you actually can’t do as it turns out, so this became a migration to a new forest.

I was mostly working on the mailbox migration, so this post only covers Exchange 2007 to 2007 cross-forest migration.

Migrate Users

ADMT was used to migrate the user accounts. The only really important thing to note here is that you must migrate the SIDs otherwise the mailbox owner will not be recognised by move-mailbox.

Move-mailbox

I had various errors, which I have listed below, but eventually managed to get the migration working with the following script.


$s = get-credential
$t = get-credential
Get-Content "mailbox.txt" | Get-Mailbox -DomainController oldDC.oldDomain.local -Credential $s | move-mailbox -TargetDatabase "CN=Mailbox Database,CN=First Storage Group,CN=Information Store,CN=newExchServer,CN=Servers,CN=Exchange Administrative Group (FYDIBOHF23SPDLT),CN=Administrative Groups,CN=First Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=newDomain,DC=local" -SourceForestGlobalCatalog oldDC.oldDomain.local -GlobalCatalog newDC.newDomain.local -DomainController newDC.newDomain.local -SourceMailboxCleanupOptions none -SourceForestCredential $s -TargetForestCredential $t -Confirm:$false

The mailbox.txt file contains a list of UPNs, one per line.

 Hint: To find your mail database FQDN use ADSIEdit to bind to the Configuration partition in the destination AD.

Troubleshooting

1.  “Failed to reconnect to Active Directory.”

->  This post helped me get the script right and eradicate this error: http://forums.msexchange.org/m_1800493015/tm.htm

2.   ”MapiExceptionNetworkError: Unable to make admin interface connection to server.”

-> Don’t use administrator. Create a dedicated migration account in both forests and give it the following permissions:

  • Exchange Recipient Administrator in both forests,
  • Exchange Server Administrator on all source and destination servers,
  • Local admin on all source and destination servers,
  • Domain Admins both forests (I didn’t expect to have to do this – but see the next error).

3.  “Error occurred in the step: Updating attributes. Access denied.”

-> This was fixed by adding the Domain Admins membership in both domains. I then also found I had to restart the Exchange Management Shell.

 4.  “Failed to set basic mailbox information, will retry in 60 seconds”.

-> If you wait the 60 secs it should then work. This happens because the destination mailbox does not yet exist. For a workaround, create all the destination mailboxes using enable-mailbox and then add the -AllowMerge option to the script above.

5.  “Error occurred in the step:Approving object. No matched target NT account is found.” 

-> This will happen if you have neglected to migrate the SIDs with ADMT, or if you created new accounts in the destination domain.

For some reason I got this error with all the resource mailbox accounts, despite SID migration having been used. As we weren’t worried about profiles or passwords I ended up deleting the accounts from the destination domain, and then modifying the script above to include the -NTAccountOU option. This allowed move-mailbox to create new accounts and migrate the mailboxes.

6.  Not really an error but IT TOOK A BLOODY LONG TIME! We were really unprepared by how slow it was. As the servers were on a dedicated server VLAN with 100 MBit cards we thought it would be pretty fast – but it took over 12 hours to move 50GB. There are probably other factors here – such as the source server being a VM – but still!

7.  And in a similar vein: watch the transaction logs on the destination server. I thought I was all prepared for this one and started the day with a Full backup when the server was empty, to follow with incrementals at intervals throughout the day. But at some point I overwrote the existing backup rather than appending, and from that point Exchange helpfully hung on to its trillions of logs. I then had to wait a couple of hours for a full backup to complete so that I could finish migrating the last few mailboxes – Ugh!

8. Distribution Lists: ADMT migrated the groups and their members, but the mail alias went missing along the way. I had to export all the aliases using get-distributiongroup in the old domain, and then update the groups using enable-distributiongroup in the new domain.

9. Outlook 2003 had to be manually reconfigured to connect to the new server. It should be possible to script this in the login script, and there are various vbscripts out there on the internet, but the guys who were doing this part said they couldn’t get it to work, so in the end they did them all manually as the users arrived on Monday morning.

10.  While all the mailbox delegations were imported (even for those resource mailboxes which I had to recreate) we noticed that the delegates appeared with a question mark over the icon in Exchange Management Console – however the delegations seemed to be working fine. I couldn’t find anything about this question mark icon. Our best guess was that it was connected to the SID migration and SID history – essentially that the delegation was made with a historical SID.

Certificates

I’m not going to go into this in any great detail, mostly because I don’t understand it all that well, and don’t particularly want to.

We had to install a new CA server into the new domain, which meant a whole lot of other certs being recreated and reinstalled. That was a variously hair-tearing experience, depending on the application.

For Exchange it wasn’t too hard. I created a new Web Server cert and changed the default one using remove-exchangecertificate, import-exchangecertificate and enable-exchangecertificate. There’s a nice walkthrough here.

It was also necessary to import a couple of certs into the Local Computer store on the ISA 2006 server:

  • The root cert from the new CA had to be imported into Trusted Root Authorites, and
  • The new Exchange server cert had to be imported into Personal.

After that it was just a matter of changing the OWA and ActiveSync configurations to reference the new Exchange server.

{ 10 } Comments

  1. imatone | March 18, 2009 at 5:13 pm | Permalink

    I’m abt to embark on Option#2 and absolutely & positively ruled out Option#1 cuz I/we do that for living. So, ur post or ur web site is truly a lifesaver or I should say job saver. Tks for sharing! Btw, do U do consulting work?

  2. Carol | March 18, 2009 at 5:47 pm | Permalink

    Hi there, thanks for your comment, and yes I am a consultant.
    Good luck with it and be prepared for odd side effects. Oh and I totally recommend naming the new domain something really generic so you won’t ever have to do this again!

  3. imatone | March 18, 2009 at 6:05 pm | Permalink

    It’s one of those M&A AD + Exchange consolidation projects. 3 companies will be merging into one therefore all 3 domains will be migrating into a new forest. You mentioned “odd side effects” – such as? Have U worked w/ Quest Migration Manager or similar tools?

  4. Carol | March 18, 2009 at 6:35 pm | Permalink

    I haven’t worked with Quest but have heard only good things.
    The side effects will depend on what other services you have to migrate, it’s just difficult gtoi capture them all ahead of time. At least if it’s a merger I’m guessing that you should be able to set up trusts and migrate things progressively.

  5. imatone | March 18, 2009 at 6:57 pm | Permalink

    Indeed, other services. They have a SharePoint 2K7 server and half a dozen of Sql2K5 servers. To make it even more interesting, their current setup lacks any FT/HA or DRP. After the AD+E2K7 migration, we will setup a pair of XenServers and on top of it will run Marathon VM. Almost forgot! We will install QAM (Quest Archive Manager) on the new forest/domain, ABYM (Archive Before U Migrate). Sounds like an interesting project you would like to participate? Well, remotely? We can use ur expertise.

  6. Carol | March 19, 2009 at 11:33 am | Permalink

    Ah well, that’s a nice offer, but probably not so practical as I’m pretty busy with projects here in Geneva. I’m sure you’ll manage – just take things slowly!

  7. imatone | March 19, 2009 at 11:44 pm | Permalink

    Our door is always open. Let me know when U have spare time. Tks again for sharing ur valuable E2K7 migration experience w/ us!

  8. imatone | March 24, 2009 at 5:35 pm | Permalink

    http://theessentialexchange.com/blogs/michael/archive/2008/04/04/exchange-2007-and-domain-rename.aspx

  9. Killerbe | April 23, 2009 at 12:14 pm | Permalink

    I working on a forest consolidation. Still have find out how to cover the oulook profiles.
    I am using ADMT and Move-Mailbox to move the mailbox. The user and mailbox are linked in the target forest, but when loging on to the client the user gets directed (by autodiscovery) to the exchange (2007) server in the source forest. I haven’t migrated th euser profile yet, by which the autodiscover kicked in. But how comes i get pointed to the source exchange server. I have verified that the account which is logged in, is the one which is now member of the target domain, and is logged on to the target forest.

  10. Carol | April 23, 2009 at 4:38 pm | Permalink

    Killerbe,
    sorry can’t really help you as I’ve only done this the one time, and I didn’t have that particular problem – quite possibly because we didn’t have any coexistance phase – the whole job was done in one weekend. The only thing I can think of – have you moved the workstation to the new domain yet?

Endep online order order buy Endep online purchase Endep online without script buy generic Endep from india buy in Endep uk where to buy Endep without a prescription Endep from canada buy 10 mg Aricept generic Aricept cost order Nizoral no visa Nizoral 200 mg buy cheap Nizoral line Nizoral on line best finpecia online pill Requip Requip free Requip uk Amitriptyline generic buy generic Amitriptyline from india where buy Lisinopril purchasing finpecia with overnight delivery Nizoral online buy saturday delivery buy Nizoral in mo finpecia online how to buy Cytotec online without a rx order Aricept pharmacy buy Aricept with no prescription buy Amitriptyline no perscription cod Online us Requip how to buy Amitriptyline without a prescription buy line Amitriptyline buy Amitriptyline money buy purchase Accutane 40 mg on line no rx Accutane 40 mg sale order 40 mg Accutane online next day delivery 40 mg Accutane online buy Lisinopril pay cod Lisinopril overnight cod buy lisinopril without prescription buy lisinopril purchase Premarin cod next day delivery where buy Premarin buy Premarin online free fedex delivery Premarin cheapest place to buy Metformin purchase Metformin online generic 20mg prednisone online finpecia online overnight buy finpecia cheap buy Metformin toronto Metformin prescription buy Metformin where metformin purchased online without prescription buy metformin online cod purchase metformin money purchase order Metformin usa buy metformin cash on delivery how to order prednisone online without a prescription online prescriptions prednisone buy online rx finpecia without fedex finpecia overnight without a prescription buy Metformin discount can i order finpecia onlinebuy finpecia cheap prednisone prescription cost Metformin canadian pharmacy buy cheap generic Metformin online lisinopril buy lisinopril