Microsoft
provides several tools to help organizations move from Windows NT 4.0
and Exchange 5.5 to Windows 2000 and Exchange 2000. Each tool performs
a particular function, and can be used in conjunction with other tools
to provide a coexistence or migration solution. In this article, I'll
focus on the Active Directory Connector (ADC). (For information on
other migration tools, see the sidebar "Migration
Components").
The Exchange 2000 ADC plays an important role in Exchange 5.5 and
Active Directory coexistence. It synchronizes directory objects
between Exchange 5.5 and Active Directory. This enables organizations
that have maintained an attribute rich Exchange 5.5 directory to bring
that data across to their Active Directory and keep it synchronized.
During synchronization, the ADC matches Exchange 5.5 objects with
equivalent Active Directory objects: Exchange 5.5 mailboxes are
equivalent to Active Directory users; Exchange 5.5 custom recipients,
to Active Directory mail-enabled contacts; and Exchange 5.5
distribution lists, to Active Directory groups.
There are two versions of the ADC: a Windows 2000 version and an
Exchange 2000 version. The Windows 2000 version only synchronizes mail
recipient objects and you can use it to populate Active Directory and
centralize administration of the two directories. The Exchange 2000
version also synchronizes configuration objects between the two
directories. This is required for coexistence between Exchange 5.5 and
Exchange 2000. The Exchange 5.5 sites' configuration objects are
synchronized to Active Directory to provide Exchange 2000 Servers with
knowledge of the sites, servers, and other configuration objects
necessary to coexist. And the Exchange 2000 setup won't allow an
Exchange 2000 Server to join an Exchange 5.5 site if the Exchange 2000
version of the ADC isn't installed in the enterprise.
The ADC associates portions of each directory with connection
agreements. Connection agreements are established between Exchange 5.5
sites and Active Directory domains to define which objects from each
directory should be synchronized and where this should happen. A
container in the Exchange directory, such as a recipient container, is
associated with a container in the Active Directory domain, such as an
organizational unit. The objects in these containers are synchronized
based on the schedule defined in the connection agreement.
Synchronization occurs using Lightweight Directory Access Protocol
(LDAP) between an Exchange 5.5 server, a Windows 2000 Server running
ADC, and an Exchange 2000 domain controller configured as a Global
Catalog server. If you plan to run Exchange 5.5 on a Windows 2000
domain controller, you must change the Exchange LDAP port to something
other than port 389, the one Windows 2000 uses.
Both the Windows 2000 and Exchange 2000 ADC versions have
connection agreements that synchronize mail-enabled objects between
directories. It's important to define where ADC connection agreements
are needed in your environment before implementing the ADC.
Configuration can be more complex. You can configure the connection
agreement for one-way synchronization, in either direction, or for
two-way synchronization, based on your requirements. One-way
synchronizations will only write changes to the directory in one
direction. It's also possible to configure the types of objects a
connection agreement will synchronize (see
Figure 1).
To add to the complexity, you should define at least one connection
agreement per site and domain as the primary connection agreement.
This agreement creates new objects in the destination directory if
those objects don't exist. Although it's not required, it's
recommended you define only one primary connection agreement for each
site and domain to avoid creating duplicate objects in the forest (see
Figure 2).
In multisite and multidomain environments, you should take care to
ensure objects are synchronized as needed. Where you define your
connection agreements and which ones you designate as primary
connection agreements depends partly on the ultimate location of your
user accounts. It's important to fully understand the ADC and how you
can use it in different environments; you'll quickly realize that the
ADC and its configuration can be quite complex—so you'll need to plan
for it and deploy it carefully.