The purpose of this document is to provide information on how to use Binary Tree SMART Directory Sync to perform synchronizations from a source to a target Active Directory.

1.2 Audience for AD Migration/Synchronization and Exchange

Migration

It is assumed the reader has the following technical expertise: o Advanced Active Directory & Exchange Administration o Windows Administration o SQL Administration o LDAP o SMTP Routing o DNS

1.3 About SMART Directory Sync for AD Migration/Synchronization and Exchange Migration

SMART Directory Sync allows you synchronize objects from a source to a target Active Directory. Directory Sync has been carefully design and crafted to meet the challenging requirement for a solution that can deliver a reliable, secure, and automated solution that synchronizes and transforms directory data between Active Directory environments supporting Exchange 2003, 2007, 2010, and 2013.

Key Features and Functions

 Sync Reports allow you to view how objects will appear in the target directory before synchronizing a profile.

This allows for the remediation of any data issues without impacting the target directory.



Synchronize user objects from a source Active Directory to a target Active Directory



Synchronize objects ‘As-is’, as Contacts, as mail-enabled users or as disabled mail-enabled users



Customizable attribute matching logic



Synchronize Active Directory groups and distribution lists from a source Active Directory to a target Active

Section 2. Configuring AD Migration/Synchronization and Exchange Migration Synchronization Profiles

The SMART Directory Sync Console provides an easy to follow wizard for creating directory synchronization profiles between Active Directories. It also allows you to quickly manage profiles and immediately start synchronization.

To begin configuring the synchronization, start the installed SMART Directory Sync Console.

2.1 Applying a License

All SMART Directory Sync profile types are licensed for the number of user objects and contacts. A license key must be added in order to synchronize objects to a Target.

To apply a license:

1. On the SMART Directory Sync Console, click the License button. The License dialog window appears.

2. Click the Apply License button.

3. Browse to and select the license (.lic) file obtained from Binary Tree, and then click Open.

4. The license details appear in the dialog window. Click Close to close the window.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

2.2 Adding an AD Migration/Synchronization Profile

The SMART Directory Sync AD Migration/Synchronization profile is used for both AD to AD directory synchronization and in support of an Active Directory migration utilizing Binary Tree’s SMART Active Directory Migrator product. To add an AD Migration/Synchronization profile:

1. On the Profiles tab, click Add Profile.

2. In the Profile Type Selection window, select AD Migration/Synchronization and then click OK. The other

Profile Types are detailed in the SMART Directory Sync documentation.

3. A new pane appears at the bottom of the console which provides the ability to configure options for synchronization.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

4. On the General tab, enter a name to identify the profile in the Name field.

5. Select the scope of the profile from the Scope drop-down list: o Inter-Forest– (default) will synchronize domains in different forests. o Intra-Forest – will synchronize domains within a forest. If selected, the Add x500 Proxy to Source and

Resource Forest options must be set to No and msExch mappings are invalid.

6. Select the status of the profile from the Status drop-down list: o Active– will synchronize manually or as scheduled as soon as the profile is saved o Suspended – Not active, will not synchronize

7. Select the logging level of the profile from the Logging drop-down list: o Low – only errors are logged o Medium – errors and warnings are logged o High – all messages (errors, warnings, information, etc.) are logged (should be used for troubleshooting purposes only)

8. For Schedule, select the schedule: o By frequency – enter the appropriate frequency or the specific time for the synchronization process to run for your environment. Zero (0) is not a valid value for frequency. The minimum interval is 15 minutes. o At specific times(s) – enter one or more specific times or select times from the drop-down list of times. o Manual only – the synchronization process will not run until it is manually started.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Active Directory Migrator profiles only push objects to SQL based on the selected schedule option. Objects must be marked in the SMART AD Migrator as "Ready to Sync" to pull the objects to the target with the sync process.

If you choose the By frequency option, SMART Directory Sync will initiate a synchronization when an active profile is saved. Select the At specific time(s) option and select a time in the future or select the Manual only option if you want to save an active profile without it syncing right away. This would be helpful if you wanted to run a Sync Report or inspect items in SQL before pulling them into the target Active Directory.

9. Click the AD Source tab enter credentials that have read/write access to the source Active Directory. The required read access must extend to the Deleted Accounts container, which can require a privileged account.

10. In the User Name field, enter the Active Directory User Name.

The credential should be entered as a user principal name (for example, [email protected])

11. In the Password field, enter the password assigned to the Active Directory user.

12. In the Global Catalog Server field, enter the IP Address or fully qualified domain name of the server (FQDN) for the Global Catalog Server or a Domain Controller that will be used for all read/write operations.

The entered credentials and Global Catalog Server/Domain Controller must have access to all Domains and subdomains that are required to synchronize.

If SID History will be synchronized, SMART Active Directory Migrator will require access to the domain controller holding the PDC Emulator Active Directory FSMO role in all source and target domains.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

13. Select an Attribute Change Detection option from the drop-down list: o Enabled– Only attributes changed on the source object will be synchronized o Disabled– All attributes on the source object will be synchronized

14. Select an Automatically Mark Objects as Ready to Sync option from the drop-down list:

 No – (default) Objects are not marked as Ready to Sync. No should be selected if you are using

SMART AD Migrator to perform an AD migration. Objects can be marked as ready to sync in the

SMART AD Migrator Console.



Yes – Objects are marked as Ready to Sync. Objects will be synced during the synchronization. Yes should be selected if you are performing an AD to AD directory synchronization and not a full

AD migration.

15. Click Add OU(s) to display a list of OU(s) (organizational units) available to synchronize.

Note that a synchronization profile that includes the OU where the computer objects reside should be created.

16. Select the appropriate source OU’s and click OK. The selected source OUs are displayed in the Source OUs table.

To deselect an OU from the source, select it and then click the Remove OU button and confirm.

17. The following Source OU fields display at the bottom of the screen used in the above example.



Source OU (not editable) – Reflects the OU selected from the tree view.



Sub OUs – Select this option to synchronize Sub-OUs. The checkbox is selected by default. Clear this option if you do not want to synchronize sub-OUs.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION



Groups – The checkbox is selected by default. Clear this option to skip groups from being synchronized.



Disabled Users– Select this option to synchronize Disabled Users. The checkbox is selected by default.

Clear this option to prevent Disabled Users from being synchronized.



Non-Mail Enabled – Select this option to synchronize Non-mail enabled objects. The checkbox is not selected by default. Clear this option to skip Non-mail enabled objects from being synchronized.



User Filter– This is an LDAP filter and can be used to filter synchronization to specific object types or those objects exhibiting specific attribute properties. See the Using the User and Group LDAP Filter topic in the SMART Directory Sync documentation for more information.



Group Filter– This is a LDAP filter and can be used to filter groups based on the entered criteria. See the

Using the User and Group LDAP Filters topic in the SMART Directory Sync documentation for more information.

It is recommended that you test the LDAP filter syntax prior to saving your changes and running a synchronization.

18. Click the Source DCs tab to define the list of Source Domain Controllers (DCs) used for synchronization.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

19. Click Add DC(s) to open the Active Directory DC Selection window. Click Refresh DCs to find all available

Domain Controllers. Available options include Ping Servers to test the availability of the selected Domain

Controllers and Test Connections to test the connection to the LDAP server. Select one or more Domain

Controller and click OK to add the Domain Controllers to the list of Source DCs.

If your Active Directory forest contains more than one domain it may be necessary to add at least one domain controller from each domain. When SMART Directory Sync attempts to resolve objects, such as group members or a user's manager, that are in another Domain (than the one specified on the Source tab), it will reference the domain controllers list to find a valid DC to use.

To ensure that group membership and manager/subordinate relationships are properly recreated, it is recommended to add the appropriate DC’s for alternate domains to the Source DC’s tab.

20. The Active Directory DC Selection window closes and the selected Domain Controllers appear in the Source

Domain Controllers with no priority set will be used after those with a priority.

If no priority is set for the servers in a Domain, they will be used in the order listed in the table.

A Domain Controller that is the Global Catalog Server selected on the AD Source tab is given top priority regardless of the value in the Priority field.

No two DC’s in a Domain can have the same priority.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

21. Click the AD Target tab.

22. In the User Name field, enter the name of the Active Directory user that has the required rights to the Target directory.

The credential should be entered as a user principal name (for example, [email protected])

23. In the Password field, enter the password of the Active Directory user. These credentials should have write access to target OU, as well as any Domains or subdomains that may contain matched users.

24. In the Global Catalog Server field, enter the IP Address or fully qualified domain name of the server (FQDN) of the Global Catalog Server or Domain Controller that will be used for all write operations.

25. In the Target OU, Click Browse to select a target OU. Any newly created objects will be written to this OU.

26. Select an option from the Synchronize Passwords drop-down list: o No – (default) Passwords will not be copied to the target o Yes – Passwords will be copied to the target.

Passwords are only copied to the target for accounts in the target created by SMART Directory Sync.

The password policy on the source must meet or exceed the password policy strength on the target.

An error will occur if the Administrator password contains double quotes (") when performing password synchronization. To work around this, ensure the administrator password does not contain double quotes.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

27. Enter a default password for new users in the Default Password field.

The default password cannot exceed 128 characters in length.

Even if Passwords are being copied, and default password value is still required as the initial account is created with the default password, and then the source password is copied over.

28. Click the AD Target Options tab.

29. Select an option from the Create Mail Enabled Users as drop-down list:



For Inter-Forest:



As Is – (default)



Mail-Enabled Users in the source will be Mail-Enabled Users in the target



Mailbox-Enabled Users in the source will become Mail-Enabled Users in the target

 The Active Directory User Account Control property for enabled or disabled will be copied as is. In other words, user accounts that are enabled in the source, will be enabled in the target.



Mail-Enabled Contacts in the source will be Mail-Enabled Contacts in the target



Mail-Enabled, AD Enabled –

 The Active Directory User Account Control property for enabled or disabled will always be set to Enabled. In other words, user accounts that are disabled in the source, will be enabled in the target



Mail-Enabled Users in the source will be Mail-Enabled Users in the target



Mailbox-Enabled Users in the source will become Mail-Enabled Users in the target

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION



Mail-Enabled Contacts in the source will be Mail-Enabled Contacts in the target



Mail-Enabled, AD Disabled –



The Active Directory User Account Control property for enabled or disabled will always be set to Disabled. In other words, user accounts that are enabled in the source, will be disabled in the target.



Mail-Enabled Users in the source will be Mail-Enabled Users in the target



Mailbox-Enabled Users in the source will become Mail-Enabled Users in the target



Mail-Enabled Contacts in the source will be Mail-Enabled Contacts in the target



Contact – Mail-Enabled, AD Disabled –



This option IS NOT RECOMMENDED for Active Directory Migrator projects as user accounts will NOT be created in the target



Contacts, Mailbox-Enabled Users, Mail-Enabled Users will be created as Mail Enabled

Contacts in the target



This option does not have logon capabilities, but can be used for maintaining mail flow for existing users, contacts and distribution lists



For Intra-Forest:

Microsoft Exchange cannot have duplicate objects in the same organization. As a result, all mail-enabled objects will have Microsoft Exchange properties removed, effectively creating non-mail enabled objects regardless of the source object type.



As Is – (default)



Mail-Enabled Users in the source will be non-mail enabled users in the target



Mailbox-Enabled Users in the source will become non-mail enabled users in the target



The Active Directory User Account Control property for enabled or disabled will be copied as is. In other words, user accounts that are enabled in the source, will be enabled in the target



Mail-Enabled Contacts in the source will be Non-Mail Enabled Contacts in the target



Mail-Disabled, AD Enabled –



The Active Directory User Account Control property for enabled or disabled will always be set to Enabled. In other words, user accounts that are disabled in the source, will be enabled in the target



Mail-Enabled Users in the source will be Non-Mail Enabled Users in the target



Mailbox-Enabled Users in the source will become Non-Mail Enabled Users in the target



Mail-Enabled Contacts in the source will be Non-Mail Enabled Contacts in the target



Mail-Disabled, AD Disabled –



SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION



Mail-Enabled Users in the source will be Non-Mail Enabled User in the target



Mailbox-Enabled Users in the source will become Non-Mail Enabled Users in the target



Mail Enabled Contacts in the source will be Non-Mail Enabled Contacts in the target



Contact – Mail-Enabled, AD Disabled –



This option IS NOT RECOMMENDED for Active Directory Migrator projects as user accounts will NOT be created in the target.



Contacts, Mailbox-Enabled Users, Mail-Enabled Users will be created as Non-Mail Enabled

Contacts in the target.



This option does not have logon capabilities, but can be used for maintaining mail flow for existing users, contacts and distribution lists.

The Mail-Enabled, AD Enabled option creates Active Directory users with logon capabilities in the target domain and all properties from the source’s object, including mail addresses.

The Mail-Enabled, AD Enabled option can override the properties found in the Source AD environment.

For example, a Disabled Mail-Enabled User found in the source will be enabled in the target if the Mail-

Enabled, AD Enabled option is selected. Conversely, an enabled user found in the source will be disabled in the target if the Mail-Enabled, AD Disabled option is selected.

Directory Sync will not create Mailbox-Enabled Users in the target directory.

Due to a sAMAccountName size limit of 20 characters in Active Directory, user objects with calculated sAMAccountName names greater than 20 characters in length are truncated to 20 characters. Truncated sAMAccountNames will be appended with a random number from 1 to 9999 to ensure uniqueness. This does not apply to group objects.

30. Select an option from the Create Non-Mail Enabled Users as drop-down list: o As Is – (default) The Active Directory User Account Control property for enabled or disabled will be copied as is. o Enabled – The Active Directory User Account Control property for enabled or disabled will always be set to Enabled for Non-Mailed Enabled Contacts and Users. Non-Mailed Enabled contacts are always copied as is. o Disabled – The Active Directory User Account Control property for enabled or disabled will always be set to Disabled for Non-Mailed Enabled Users. Non-Mailed Enabled contacts are always copied as is.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

31. Select an option for handling user account collisions when two users of the same name are found from the Users

Collisions drop-down list:



Update – (default) If a user with the same name is found in the target domain, the users will be added to the target group. User collisions are determined based on the options selected on the Matching tab of the profile.



Skip – The user will not be synchronized into the target AD and a warning entry will be entered into the log entry stating that the source user will not be synchronized to the target directory.

A user that was previously synchronized to the target will fail to sync if a manual /repushpull /resync is run. This occurs because a target object with a matching sAMAccountName will already exist. If this is not the desired behavior, before running the /repushpull and /resync commands, administrators should clear the target directory of any previously created objects.



Rename - This allows you to define a prefix or suffix to be added to the name of the user when it is written in the target directory. This option creates a new user using the existing name and the prefix or suffix to bypass the user collision when selected. Prefix is selected by default.

User accounts where the sAMAccountName exceeds 20 characters will not be created in the Target and an error will be logged.

32. Select an option from the Do not overwrite target Proxy Addresses drop-down list: o Yes – Proxy Addresses will only be updated during initial sync if the target object has no proxy addresses.

Proxy addresses will not be updated on subsequent syncs. o No – (default) Proxy Addresses on the target are overwritten.

33. Select an option from the Sync Objects drop-down list: o One-Time – objects are synced once after being marked as "Ready to Sync" in the SMART AD Migrator console. Additional syncs are not performed if there are changes in the source.

Groups are not continuously synced. However, group membership is continuously updated. o Continuous – (default) objects are continually synced between the source and target after being marked as "Ready to Sync" in the SMART AD Migrator console.

34. Select an option from the Synchronize SID History drop-down list: o Yes – SID history is synchronized. This option is not available for Intra-Forest profiles.

Review the Requirements for more information on Synchronizing SID History Prerequisites. o No – (default) SID history is not migrated.

Synchronizing SID History is recommended. Windows has built in processes that use SID History to update internal OS functions including Windows 8.x Modern Apps, Network Printers, and Microsoft Outlook.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

35. Select an option from the Create Domain Local Groups as drop-down list:



Domain Local – (default) Domain Local Groups in the source will be Domain Local Groups in the target.



Universal – Domain Local Groups in the source will be Universal Groups in the target.



Do Not Create – Domain Local Groups in the source will not be created in the target.

36. Select an option from the Create Global Groups as drop-down list:

 Global – (default) Global Groups in the source will be Global Groups in the target.



Universal – Global Groups in the source will be Universal Groups in the target.



Do Not Create – Global Groups in the source will not be created in the target.

37. Select an option from the Create Universal Groups as drop-down list:



Universal – (default) Universal Groups in the source will be Universal Groups in the target.



Domain Local – Universal Groups in the source will be Domain Local Groups in the target.



Do Not Create – Universal Groups in the source will not be created in the target.

38. Select an option for handling group collisions when two groups of the same name are found from the Group

Collisions drop-down list:



Merge – If a group with the same name is found in the target domain, the members of the source group will be added to the target group. Groups are determined to be the same based on matching sAMAccountName, Internet Address, Common Name, and Name.



Skip – The group will not be synchronized into the target AD and a warning entry will be entered into the log entry stating that the source group will not be synchronized to the target group.

A group that was previously synchronized to the target will fail to sync if a manual /repushpull /resync is run. This occurs because a target object with a matching sAMAccountName will already exist. If this is not the desired behavior, before running the /repushpull and /resync commands, administrators should clear the target directory of any previously created objects.



Rename - This allows you to define a prefix or suffix to be added to the name of the group when it is written in the target directory. This option creates a new group using the existing name and the prefix or suffix to bypass the group collision when selected. Prefix is selected by default.

No option is selected by default. An error message will appear if attempting to save the profile without selecting an option.

Directory Sync will attempt to add a group member to the target if it can find the member in the source. If the member in the source is in a different Domain than the group, the member will only be added to the group in the target if it already exists in the target. If Directory Sync cannot find the member in the source, the member will not be added to the group in the target. The Sync Report will explain why a member could or could not be synchronized.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

39. Click the Exchange Target Options tab.

40. Select an option from the GAL Visibility drop-down list:



Visible – (default) Users and groups are visible in the GAL.



Hidden – Users and groups are hidden in the GAL.



As Is – Users and groups that are hidden in the GAL in the source are hidden in the GAL in the target.

Users and groups that are visible in the GAL in the source are visible in the GAL in the target.

When synchronizing objects into Exchange 2003 (only), the option to hide from the GAL will not function if the

Recipient Update Service (RUS) is enabled.

If synchronizing to an Active Directory that does not have Exchange in the environment, select the Hidden option to avoid Active Directory constraint errors.

This option does not apply to Intra-Forest profiles.

41. Select an Only Update Mailbox Enabled Objects option. If you select Yes, only mailbox-enabled objects in the target directory will be updated with values from the source object based on the mapping table settings. If this is set to No (default), mailbox-enabled objects in the target directory will be skipped and noted in the sync report.

If you intend to update both, you must use two separate profiles.

CAUTION: This is not a commonly occurring preference as the authoritative object is most often where the mailbox is located.

42. The Add x500 Proxy to Source option allows you to add the LegacyExchangeDN of any mail enabled object in the target as an additional X500 proxy address to the source mailboxes. If Yes is selected, an x500 proxy address is added to all corresponding objects in the AD Source forest. If selecting Yes, you must check the statement of understanding that appears below the option. No is selected by default.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

This option must be set to No for Intra-Forest profiles.

43. The Resource Forest option allows you to define the AD Target as a Resource Forest. This is required if you plan to later migrate mailboxes to your Target forest. If Yes is selected, the Master Account SID will be set on the AD

Target objects. No is selected by default.

This option must be set to No for Intra-Forest profiles.

44. The Allow Enable/Disable of Mailbox Enabled Source Objects option allows you to define if enabling or disabling Mailbox Enabled Source objects is allowed. If Yes is selected, the enabling or disabling of Mailbox

Enabled Source objects is allowed. No is selected by default.

45. Select Email Address Policy options for Users, Contacts, and Groups:



Unselected – (default) Directory Sync will not enable the target object attribute to ‘Automatically update email addresses based on email address policy’ in Exchange.



Selected – Directory Sync will enable the target object attribute to ‘Automatically update email addresses based on email address policy’ in Exchange.

Directory Sync will only apply the attribute to ‘Automatically update email addresses based on email address policy’ to the target object. It cannot apply the email address policy.

This option does not apply to Intra-Forest profiles.

46. If selected the Email Address Policy option for User, Contacts, or Groups, a drop-down list appears with the following options:



Enable email policy for objects created by DirSync



Enable email policy for objects updated by DirSync



Enable email policy for objects created or updated by DirSync



Disable email policy for objects created by DirSync



Disable email policy for objects updated by DirSync



Disable email policy for objects created or updated by DirSync

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

47. Click the Target DCs tab to define the list of target Domain Controllers (DC’s) to use when Directory Sync is searching for matched objects.

48. Click Add DC(s) to open the Active Directory DC Selection window. Click Refresh DCs to find all available

Domain Controllers. Available options include Ping Servers to test the availability of the selected Domain

Controllers and Test Connections to test the connection to the LDAP server. Select one or more Domain

Controller (use Ctrl+Click to select more than one) and click OK to add the Domain Controllers to the list of

Target DCs.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

If you selected Domain level matching in the Target tab, only select Domain Controllers for the target Domain.

No other Domains will be searched.

If you have selected Forest level matching in the Target tab, you must add at least one Domain Controller for each Domain that should be searched for matched objects. If you do not select at least one Domain Controller for a Domain, that Domain will not be searched during synchronization.

Select more than one Domain Controller in a Domain for failover purposes.

Additionally defined Domain Controllers are only searched for matches if the previous Domain Controller is unavailable.

49. The Active Directory DC Selection window closes and the selected Domain Controllers appear in the Target DC’s list. The order the domain controllers are used can be selected by entering a number value in the Priority column

(lowest number = first). Available options include Ping Servers to test the availability of the selected Domain

Controllers and Test Connections to test the connection to the LDAP server.

Domain Controllers with no priority set will be used after those with a priority.

If no priority is set for the servers in a Domain, they will be used in the order listed in the table.

A Domain Controller that is the Global Catalog Server selected on the AD Target tab is given top priority regardless of the value in the Priority field.

No two DC’s in a Domain can have the same priority.

50. Click the Matching tab.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

51. Select an option from the Matching Level drop-down list:



Forest – (default) Matching is done against the target Forest



Domain – Matching is done against the target Domain

This option is set to Domain for Intra-Forest profiles.

52. Select an option from the Matching Action drop-down list: o Create or Update – (default) Creates objects that do not have matching objects in the Target and updates objects that have matching objects in the Target o Create only – Creates objects that do not have matching objects in the Target. Objects that have matching objects in the Target are NOT updated. o Update only – Updates objects that have matching objects in the Target. Objects that do not have matching objects in the Target are NOT created. o Match only, No Update – Matching objects are updated in SQL, but no updates are done in the Target and no new objects are created in the Target.

53. Select the Match object types option to enable object type matching. Object types are Users, Contacts, and

Groups. This option is enabled (checked) by default.

54. The default source to target attribute matching pairs are displayed. This defines what attributes Directory Sync will use to match objects in the Source to objects in the Target, as well as the order in which they will be used.

The below table displays the default matching attribute pairs:

Source Target sAMAccountName mail cn sAMAccountName mail cn

To customize the matching, select attributes from the drop-down lists under Source and/or Target or type in the names of attributes in the fields. The matching pairs are “either/or” statements (not “and” statements) with the first match attempted on the top row pair (Default: sAMAccountName -> sAMAccountName) and then proceeding in descending order to the next row pair and so on. A single Source attribute cannot be paired with more than one Target attribute. However, more than one Source attribute can be paired with a single Target attribute. At least one matching pair is required for the profile to be saved.

55. Click the Mapping tab to view the default mapping or to edit how attributes should be translated from the source to the target Active Directory. Review the table and make the appropriate changes for your environment.

Double-click a cell in the mapping table select a different field or type from a drop-down list. Click above the first row to create a new entry. Double-click on a cell in the Comments column to enter a comment. Appendix C contains the default mapping.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

The default mapping for attributes will be applied unless deleted. When creating custom mapping for an attribute, the default mapping for the attribute should be deleted.

There are two Target Type columns in the table. This allows you to restrict the type of object in the target directory that can be updated. If you set both types to the same value, then this mapping will only apply to that object type. If you set one to person and the other to group, the mapping will apply to user and group objects only. If both are set to any, the mapping is unrestricted and will apply to all object types.

The msExch mappings are not valid for Intra-Forest profiles.

Values that can be used for either mapping or matching can be entered manually or imported from a CSV file in the Mapped Values dialog box.

1. Click the Mapped Values button. The Mapped Values window appears.

2. Values can be entered manually by clicking on the first row.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

3. Values can also be imported from a CSV file by clicking the Import button.

4. Select a CSV file that has Source fields and values, Target fields and values, and the application of the mapping or matching.

56. Click Save to verify all required fields are populated and save the profile. You can save an incomplete profile as long as it is suspended.

57. Click Overrides to open the table of mapping overrides. These represent default system mappings specifically for the internal SQL fields, and are used to transpose values during creation and synchronization. Overrides are customizable and apply to all profiles. See Appendix D for more information on editing Overrides.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

58. Click License to and then Apply License to select the SMART AD Migrator license file.

59. Create additional synchronization profiles as needed. To copy an existing profile, right-click on a profile in the table and select Copy. All profile settings will be copied into a new profile that can then be edited as necessary.

New profiles created by copy are suspended by default. Select the profile in the table and click Activate Profile.

2.3 Adding an Exchange Migration Synchronization Profile

The SMART Directory Sync Exchange Migration synchronization profile is used in support of an Exchange migration utilizing Binary Tree’s E2E Complete product. To add an Exchange Migration synchronization profile:

1. On the Profiles tab, click Add Profile.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

2. In the Profile Type Selection window, select Exchange Migration and then click OK.

3. A new pane appears at the bottom of the console which provides the ability to configure options for synchronization.

4. On the General tab, enter a name to identify the profile in the Name field.

Resource Forest options must be set to No and msExch mappings are invalid.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

9. Click the AD Source tab enter credentials that have read access to the source Active Directory. The required read access must extend to the Deleted Accounts container, which can require a privileged account.

10. In the User Name field, enter the Active Directory User Name.

The credential should be entered as a user principal name (for example, [email protected])

11. In the Password field, enter the password assigned to the Active Directory user.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

The entered credentials and Global Catalog Server/Domain Controller must have access to all Domains and subdomains that are required to synchronize.

14. Click Add OU(s) to display a list of OU(s) (organizational units) available to synchronize.

15. Select the appropriate source OU’s and click OK. The selected source OUs are displayed in the Source OUs table.

The synchronize Sub OUs and other checkboxes only display when you select an OU and then click the Add

OU(s) button.

To deselect an OU from the source, select it and then press the Delete key on your keyboard.

16. The following Source OU fields display at the bottom of the screen used in the above example.



Source OU (not editable) – Reflects the OU selected from the tree view.



Sub OUs – Select this option to synchronize Sub-OUs. The checkbox is selected by default. Clear this option if you do not want to synchronize sub-OUs.



Groups –The Groups tab will be disabled if there are no OUs selected for synchronizing groups. The checkbox is selected by default. Clear this option to skip groups from being synchronized.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION



Disabled Users– Select this option to synchronize Disabled Users. The checkbox is selected by default.

Clear this option to prevent Disabled Users from being synchronized.



User Filter– This is a LDAP filter and can be used to filter synchronization to specific object types or those objects exhibiting specific attribute properties. See Using the User and Group LDAP Filters for more information.



Group Filter– This is a LDAP filter and can be used to filter groups based on the entered criteria. See

Using the User and Group LDAP Filters for more information.

The default User Filter and Group Filter values can be customized for your environment by editing the configuration file and changing the DefaultUserOUFilter and DefaultGroupOUFilter values. Binary Tree recommends that you test the LDAP filter syntax prior to saving your changes.

17. Click the Source DCs tab to define the list of Source Domain Controllers (DCs) used for synchronization.

18. Click Add DC(s) to open the Active Directory DC Selection window. Click Refresh DCs to find all available

Domain Controllers. Available options include Ping Servers to test the availability of the selected Domain

Controllers and Test Connections to test the connection to the LDAP server. Select one or more Domain

Controllers and click OK to add the Domain Controllers to the list of Source DCs.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

To ensure that group membership and manager/subordinate relationships are properly recreated, it is recommended to add the appropriate DC’s for alternate domains to the Source DC’s tab.

19. The Active Directory DC Selection window closes and the selected Domain Controllers appear in the Source

DC’s list. The order the domain controllers are used for each Domain can be selected by entering a number value in the Priority column (lowest number = first). If the highest priority DC is unavailable, Directory Sync will use the next DC. Available options include Ping Servers to test the availability of the selected Domain Controllers and

Test Connections to test the connection to the LDAP server.

Domain Controllers with no priority set will be used after those with a priority.

If no priority is set for the servers in a Domain, they will be used in the order listed in the table.

A Domain Controller that is the Global Catalog Server selected on the AD Source tab is given top priority regardless of the value in the Priority field.

No two DC’s in a Domain can have the same priority.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

20. Click the AD Target tab.

21. In the User Name field, enter the name of the Active Directory user that has the required rights to the Target directory.

The credential should be entered as a user principal name (for example, [email protected])

22. In the Password field, enter the password of the Active Directory user. These credentials should have write access to target OU, as well as any Domains or subdomains that may contain matched users.

23. In the Global Catalog Server field, enter the IP Address or fully qualified domain name of the server (FQDN) of the Global Catalog Server or Domain Controller that will be used for all write operations.

24. In the Target OU, Click Browse to select a target OU. Any newly created objects will be written to this OU.

25. Enter a default password for new users in the Default Password field.

Directory Sync does not validate the password policies present within your domains. Verify that the password entered complies with the password policy of your target environment. Objects will fail to be created if the password violates the target directory's password policy. The default password cannot exceed 128 characters in length.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

26. Click the AD Target Options tab.

27. Select an option from the Create Users as drop-down list:



For Inter-Forest:



As Is – (default)



Mail-Enabled Users in the source will be Mail-Enabled Users in the target



Mailbox-Enabled Users in the source will become Mail-Enabled Users in the target



The Active Directory User Account Control property for enabled or disabled will be copied as is. In other words, user accounts that are enabled in the source, will be enabled in the target.



Mail-Enabled Contacts in the source will be Mail-Enabled Contacts in the target



Mail-Enabled, AD Enabled –



The Active Directory User Account Control property for enabled or disabled will always be set to Enabled. In other words, user accounts that are disabled in the source, will be enabled in the target



Mail-Enabled Users in the source will be Mail-Enabled Users in the target



Mailbox-Enabled Users in the source will become Mail-Enabled Users in the target



Mail-Enabled Contacts in the source will be Mail-Enabled Contacts in the target



Mail-Enabled, AD Disabled –



SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION



Mail-Enabled Users in the source will be Mail-Enabled Users in the target



Mailbox-Enabled Users in the source will become Mail-Enabled Users in the target



Mail-Enabled Contacts in the source will be Mail-Enabled Contacts in the target



Contact – Mail-Enabled, AD Disabled –



Contacts, Mailbox-Enabled Users, Mail-Enabled Users will be created as Mail Enabled

Contacts in the target



This option does not have logon capabilities, but can be used for maintaining mail flow for existing users, contacts and distribution lists



For Intra-Forest:



As Is – (default)



Mail-Enabled Users in the source will be non-mail enabled users in the target



Mailbox-Enabled Users in the source will become non-mail enabled users in the target



The Active Directory User Account Control property for enabled or disabled will be copied as is. In other words, user accounts that are enabled in the source, will be enabled in the target

 Mail-Enabled Contacts in the source will be Non-Mail Enabled Contacts in the target



Mail-Disabled, AD Enabled –



The Active Directory User Account Control property for enabled or disabled will always be set to Enabled. In other words, user accounts that are disabled in the source, will be enabled in the target

 Mail-Enabled Users in the source will be Non-Mail Enabled Users in the target



Mailbox-Enabled Users in the source will become Non-Mail Enabled Users in the target



Mail-Enabled Contacts in the source will be Non-Mail Enabled Contacts in the target



Mail-Disabled, AD Disabled –



Mail-Enabled Users in the source will be Non-Mail Enabled User in the target



Mailbox-Enabled Users in the source will become Non-Mail Enabled Users in the target



Mail-Enabled Contacts in the source will be Non-Mail-Enabled Contacts in the target



Contact – Mail-Enabled, AD Disabled –



Contacts, Mailbox-Enabled Users, Mail-Enabled Users will be created as Non-Mail Enabled

Contacts in the target.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION



This option does not have logon capabilities, but can be used for maintaining mail flow for existing users, contacts and distribution lists.

The Mail-Enabled, AD Enabled option creates Active Directory users with logon capabilities in the target domain and all properties from the source’s object, including mail addresses.

The Mail-Enabled, AD Enabled option can override the properties found in the Source AD environment.

For example, a Disabled Mail-Enabled User found in the source will be enabled in the target if the Mail-

Enabled, AD Enabled option is selected. Conversely, an enabled user found in the source will be disabled in the target if the Mail-Enabled, AD Disabled option is selected.

Directory Sync will not create Mailbox-Enabled Users in the target directory.

28. Select an option for handling user account collisions when two users of the same name are found from the Users

Collisions drop-down list:



Skip – The user will not be synchronized into the target AD and a warning entry will be entered into the log entry stating that the source user will not be synchronized to the target directory.



User accounts where the sAMAccountName exceeds 20 characters will not be created in the Target and an error will be logged.

29. Select an option from the Do not overwrite target Proxy Addresses drop-down list: o Yes – Proxy Addresses will only be updated during initial sync if the target object has no proxy addresses.

Proxy addresses will not be updated on subsequent syncs. o No – (default) Proxy Addresses on the target are overwritten.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

30. Select an option from the Create Groups as drop-down list:



As Is – (default) Groups are created as they are in the source:



Global groups in the source will be Global groups in the target



Universal groups in the source will be Universal groups in the target



Contact – Groups will be contacts in the target.



Global Group – All groups in the source will be Global groups in the target.



Universal Group – All groups in the source will be Universal groups in the target.

Universal groups must be used if the target group will contain members from other AD Domains, otherwise those members will not be added to the group.

31. Select an option for handling group collisions when two groups of the same name are found from the Group

Collisions drop-down list:



Merge – If a group with the same name is found in the target domain, the members of the source group will be added to the target group. Groups are determined to be the same based on matching

SAMAccountName, Internet Address, Common Name, and Name.



Skip – (default) The group will not be synchronized into the target AD and a warning entry will be entered into the log entry stating that the source group will not be synchronized to the target group.



SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

32. Click the Exchange Target Options tab.

33. Select an option from the GAL Visibility drop-down list:

When synching objects into Exchange 2003 (only), the option to hide from the GAL will not function if the

Recipient Update Service (RUS) is enabled.

If synching to an Active Directory that does not have Exchange in the environment, select the Hidden option to avoid Active Directory constraint errors.

This option does not apply to Intra-Forest profiles.



Visible – (default) Users and groups are visible in the GAL.



Hidden – Users and groups are hidden in the GAL.



As Is – Users and groups that are hidden in the GAL in the source are hidden in the GAL in the target.

Users and groups that are visible in the GAL in the source are visible in the GAL in the target.

34. Select an Only Update Mailbox Enabled Objects option, if you select Yes, only mailbox-enabled objects in the target directory will be updated with values from the source object based on the mapping table settings. If this is set to no (default), mailbox-enabled objects in the target directory will be skipped and noted in the sync report.

If you intend to update both, you must use two separate profiles.

USE WITH CAUTION! This is not a commonly occurring preference as the authoritative object is most often where the mailbox is located.

35. The Add x500 Proxy to Source option allows you to add an the LegacyExchangeDN of an mail enabled object in the target as an additional X500 proxy address to the source mailboxes. If Yes is selected, an x500 proxy address is added to all corresponding objects in the AD Source forest. If selecting Yes, you must check the statement of understanding that appears below the option. No is selected by default.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

This option must be set to No for Intra-Forest profiles.

36. The Resource Forest option allows you to define the AD Target as a Resource Forest. This is required if you plan to later migrate mailboxes to your Target forest. If Yes is selected, the Master Account SID will be set on the AD

Target objects. No is selected by default.

This option must be set to No for Intra-Forest profiles.

37. Select Email Address Policy options for Users, Contacts, and Groups:



Unselected – (default) Directory Sync will not enable the target object attribute to ‘Automatically update email addresses based on email address policy’ in Exchange.



Selected – Directory Sync will enable the target object attribute to ‘Automatically update email addresses based on email address policy’ in Exchange.

Directory Sync will only apply the attribute to ‘Automatically update email addresses based on email address policy’ to the target object. It cannot apply the email address policy.

This option does not apply to Intra-Forest profiles.

38. If selected the Email Address Policy option for User, Contacts, or Groups, a drop-down list appears with the following options:

 Enable email policy for objects created by DirSync



Enable email policy for objects updated by DirSync



Enable email policy for objects created or updated by DirSync



Disable email policy for objects created by DirSync



Disable email policy for objects updated by DirSync



Disable email policy for objects created or updated by DirSync

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

39. Click the Target DCs tab to define the list of target Domain Controllers (DCs) to use when Directory Sync is searching for matched objects.

40. Click Add DC(s) to open the Active Directory DC Selection window. Click Refresh DCs to find all available

Domain Controllers. Available options include Ping Servers to test the availability of the selected Domain

Controllers and Test Connections to test the connection to the LDAP server. Select one or more Domain

Controllers (use Ctrl+click to select more than one) and click OK to add the Domain Controllers to the list of

Target DCs.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

If you selected Domain level matching in the Target tab, only select Domain Controllers for the target Domain.

No other Domains will be searched.

Select more than one Domain Controller in a Domain for failover purposes.

Additionally defined Domain Controllers are only searched for matches if the previous Domain Controller is unavailable.

41. The Active Directory DC Selection window closes and the selected Domain Controllers appear in the Target DC’s list. The order the domain controllers are used can be selected by entering a number value in the Priority column

(lowest number = first). Available options include Ping Servers to test the availability of the selected Domain

Controllers and Test Connections to test the connection to the LDAP server.

Domain Controllers with no priority set will be used after those with a priority.

If no priority is set for the servers in a Domain, they will be used in the order listed in the table.

A Domain Controller that is the Global Catalog Server selected on the AD Target tab is given top priority regardless of the value in the Priority field.

No two DC’s in a Domain can have the same priority.

42. Click the Matching tab.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

43. Select an option from the Matching Level drop-down list:



Forest – (default) Matching is done against the target Forest.



Domain – Matching is done against the target Domain

This option is set to Domain for Intra-Forest profiles.

44. Select an option from the Matching Action drop-down list: o Create or Update – (default) Creates objects that do not have matching objects in the Target and updates objects that have matching objects in the Target o Create only – Creates objects that do not have matching objects in the Target. Objects that have matching objects in the Target are NOT updated. o Update only – Updates objects that have matching objects in the Target. Objects that do not have matching objects in the Target are NOT created.

During synchronization, if a source object matches to more than one target object, the source object is skipped and a warning is generated in the sync report.

45. Select the Match object types option to enable object type matching. Object types are Users, Contacts, and

Groups. This option is disabled (unchecked) by default.

46. The default source to target attribute matching pairs are displayed. This defines what attributes Directory Sync will use to match objects in the Source to objects in the Target, as well as the order in which they will be used.

The below table displays the default matching attribute pairs:

Source Target sAMAccountName mail cn sAMAccountName mail cn

47. Click the Mapping tab to view the default mapping or to edit how attributes should be translated from the source to the target Active Directory. Review the table and make the appropriate changes for your environment.

AD Target Default Mapping for the default mapping.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

The default mapping for attributes will be applied unless deleted. When creating custom mapping for an attribute, the default mapping for the attribute should be deleted.

When creating a custom mapping and using one of the BTCustom fields for the internal SQL mapping, be sure to use a BTCustom field that has not already been used for other mappings or in the overrides. Either review this information in the SMART Directory Sync Mapping and Overrides user interface or in the SQL database.

If both are set to any, the mapping is unrestricted and will apply to all object types.

The msExch mappings are not valid for Intra-Forest profiles.

Values that can be used for either mapping or matching can be entered manually or imported from a CSV file in the Mapped Values dialog box.

1. Click the Mapped Values button. The Mapped Values window appears.

2. Values can be entered manually by clicking on the first row

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

3. Values can also be imported from a CSV file by clicking the Import button.

4. Select a CSV file that has Source fields and values, Target fields and values, and the application of the mapping or matching.

48. Click Save to verify all required fields are populated and save the profile. Incomplete profiles can be suspended and completed at a later time by clicking Suspend Profile. You can save an incomplete profile as long as it is suspended.

49. Click Overrides to open the table of mapping overrides. These represent default system mappings that apply to all profiles. You may customize Overrides. See Customizing Overrides for more information on editing

Overrides.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

50. Create additional synchronization profiles as needed. To copy an existing profile, right-click on a profile in the table and select Copy. All profile settings will be copied into a new profile that can then be edited as necessary.

New profiles created by copy are suspended by default. Select the profile in the table and click Activate Profile.

2.4 Suspending and Activating a Profile

Suspending a synchronization profile disables the profile from synchronizing. Note that you also cannot manually run a synchronization of a suspended profile using the Sync Profile button, right-click menu, or command line commands.

Suspended profiles remain in the list of profiles and can be reactivated at any time.

To suspend an active synchronization profile:

1. On the Configuration tab, select a profile you wish to suspend.

2. Click Suspend Profile. The status of the profile is changed to “Suspended”.

To activate a suspended synchronization profile:

1. On the Configuration tab, select a suspended profile you wish to activate.

2. Click Activate Profile. The status of the profile is changed to “Active”.

2.5 Removing a Profile

Removing a synchronization profile will delete it from the list of profiles. Removed profiles cannot be restored.

To remove a synchronization profile:

1. On the Configuration tab, select a profile you wish to remove.

2. Click Remove Profile.

3. Click Yes to confirm. The profile is deleted from the list of profiles.

2.6 Resetting a Profile

Resetting a synchronization profile causes the database for the profile to be cleared. This clears the sync database, not the profile properties.

If there are multiple profiles for the same AD Source and one of the profiles is reset, all data for the AD Source is deleted in the SQL database.

To reset a synchronization profile:

1. On the Configuration tab, select a profile you wish to reset.

2. Click Reset Profile.

3. Click Yes to confirm. The profile is reset.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Section 3. Running Sync Reports

3.1 Active Directory Sync Report

Overview

The Sync Report has two primary functions. The first is as an analytical tool used prior to synchronizing any objects into a target directory, and the second is as a logging feature to view the details of each synchronization.

Prior to synchronizing any object into the target, the source directory(ies) must be analyzed to identify any objects that could be problematic. This is a critical step to a successful sync and should not be overlooked.

The Sync Report reads the source directory(ies) and writes the data into SQL. This is the same action taken if you were to initiate a Push command. The source data is analyzed to determine the result if you were to Pull the data into the target directory. The Sync report should be run prior to the first sync, as well as prior to running a sync after you have made a change to the profile, to confirm the intended results.

Common issues that must be corrected prior to synchronizing Active Directories.

SMTP

Addresses

Duplicate SMTP Addresses - These objects will be skipped with a warning that the SMTP address is already in SQL.Any object you wish to sync must have a valid and unique SMTP Address.

Unique

Match

Values

Dirsync allows you to define up to 4 field/attribute pairs to match objects in the source to objects in the target. If the source value matches to more the one target object value, Dirsync will skip the object. This must be corrected if you intend for this object to synchronize to the target directory. The Sync Report allows you to see the matched object between the source and target. These should be reviewed to ensure that your match criteria are valid for your environment.

Running a Sync Report

To run a Sync Report:

1. Once you have created a profile, click the Sync Report button. This opens the Sync Report window. The example in this section is a Domino to Active Directory profile.

2. Click Run Report and Yes to confirm. Click the Refresh button to populate the UI with the most recent data.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

A sync report performs a Push into SQL, so it is important that you reset the profile prior to running a sync if you have made any changes to the source data or the profile settings. If you do not clear the profile, the data that is in SQL from the Sync Report will be pulled to the target directory.

Objects tab

This contains all of the objects in the source and the action that would have been taken had the profile been synched to the target. All of the columns can be sorted, filtered or reordered (drag and drop). Review any objects that were skipped in the Operations column, as well as any warnings in the Status column. You can double click on any entry to open the details for that object. The Details windows displays all of the details for the object, including the attributes and values that would be written to Active Directory. The Internal Fields tab displays the values that are written to SQL. Once corrected, you can run another sync report to validate the changes.

Members tab

The Members tab displays details for group synchronization. Here you can see each member of all of the groups that would be synched to Active Directory. You can filter the Status column for warnings to easily view any issues that should be resolved. The most common reason that a member of a distribution list cannot be added to the target distribution list is because the member is not in the source Domain. See the example below.

Object Summary tab

The Object Summary tab displays a summary of each object type, the operation performed, the status and the object count.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Members Summary tab

The Members Summary tab displays a summary of group membership synchronization. It displays the number of members added to groups, number of skipped members and the total number of errors or warnings.

Profile tab

The Profile tab lists all of the settings for the profile for which the Sync was run. This can be easily exported for troubleshooting purposes.

Source DCs tab

This tab appears on AD to Domino or AD to AD profiles only and displays the Domain Controllers listed in the Source

AD tab of the profile.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Target DCs tab

The Target DCs tab will display all of the Domain Controllers configured in the Target DCs tab. It also shows the priority in which they will be used. The default will always be used unless it is unreachable.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Section 4. Running Directory Sync

There are four ways to run Directory Sync: o Scheduling Directory Sync to run programmatically by defining a schedule for the synchronization profile to run.

See Configuring Active Directory Synchronization for more info. o Manually starting synchronization by selecting a profile and clicking the Sync Profile button. o Manually starting a synchronization process by right-clicking on a profile and selecting a synchronization option. o Manually run Directory Sync commands from a command line.

4.1 Manually Starting a Synchronization using a Sync Profile

A synchronization or sync report of a profile cannot be started if a synchronization or sync report of the profile is already running.

To manually start synchronization:

1. On the Configuration tab, select a profile to synchronize.

2. Click Sync Profile. The synchronization is started. This runs a complete sync of the profile (push/pull).

4.2 Manually Starting a Synchronization Process using the Right-

Click Menu

A synchronization or sync report of a profile cannot be started if a synchronization or sync report of the profile is already running.

To manually start a synchronization process:

1. On the Configuration tab, right-click a profile to synchronize.

2. Click one of the following options: o Push - Pushes all changed entries in the source to SQL o Pull - Pulls all changed entries from SQL to the target o Repush - Pushes all source entries regardless of modification date to SQL o Repull - Pulls all SQL entries regardless of modification date to the target o Repushpull - Combines the Repush and Repull commands into one step o Validate - Verifies that your profile settings are correct

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

4.3 Manually Starting a Synchronization Process from a Command

Line

A synchronization or sync report of a profile cannot be started if a synchronization or sync report of the profile is already running.

To manually start a synchronization process from a command line:

1. Open a Command Prompt window.

2. Navigate to %Program Files%/Binary Tree/Dirsync

Command Description binarytree.dirsync.exchange.exe /validate <Profile ID> Verifies that your settings are correct binarytree.dirsync.exchange.exe /push <Profile ID> Pushes all changed entries in the source to SQL binarytree.dirsync.exchange.exe /pushnopause <Profile

ID>

Same function as the /push command except console window closes when push is complete binarytree.dirsync.exchange.exe /pull <Profile ID> binarytree.dirsync.exchange.exe /pullnopause <Profile

ID>

Pulls all changed entries from SQL to the target

Same function as /pull command except console window closes when pull is complete binarytree.dirsync.exchange.exe /repush <Profile ID> Pushes all source entries regardless of modification date to

SQL binarytree.dirsync.exchange.exe /repull <Profile ID> binarytree.dirsync.exchange.exe /repushpull <Profile

ID>

Pulls all SQL entries regardless of modification date to the target

Combines the /repush and /repull commands into one step binarytree.dirsync.exchange.exe /pushpull <Profile ID> Combines the /push and /pull commands into one step binarytree.dirsync.exchange.exe /sync <Profile ID> Performs the equivalent of a /pushpull on all saved profiles without prompting the user to select one binarytree.dirsync.exchange.exe /resync <Profile ID> Performs the equivalent of a /repushpull on all saved profiles without prompting the user to select one

Binary Tree recommends that you remove existing objects from the target OU before running Repush, Repull, or

Repushpull.

If you do not include a Profile ID in the command, you will be prompted to choose one.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Section 5. Using the SMART Directory Sync Log

Viewer

The SMART Directory Sync Log Viewer allows you to view, search, export, and clear synchronization logs.

To open and view logs in the SMART Directory Sync Log Viewer:

1. In the SMART Directory Sync Console, click the View Logs button. The SMART Directory Sync Log Viewer opens.

2. The Synchronization profile is automatically selected and log entries associated with the profile are displayed.

To change the profile, select a different profile from the Profile drop-down list. Click the Refresh icon next to the

Profile drop-down list to refresh the list of profiles and the log grid.

5.1 Searching Log Entries

To search for log entries: o Enter a search term in the Search field and then click the Find icon. The table refreshes to show the search results.

5.2 Pausing a Log

You can stop the continuous scrolling of the log to allow for easier reading. This feature pauses the display only, not the logging function.

To pause the log:

1. Click the Pause icon.

2. To restart the log display, click the Play icon (next to “Paused”).

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

5.3 Showing Log Entries for a Time Period

To show all log entries for a time period: o Select a “Show...” option from the drop-down list near the upper right corner of the console. The table refreshes to show all log entries for the selected time period.

5.4 Filtering the Log

To filter the log:

1. Click the filter button on any column header to open the filter window.

2. Enter the filter criteria, and then click Filter. The table refreshes to the filtered log entries.

3. User the Clear Filter button to clear the filter.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

5.5 Grouping the Log by Column

To group the log by a column: o Drag a column header to the bar above the log table to group the log by a specific column. The table refreshes grouped by the selected column.

5.6 Viewing Log Entry Details

To view log entry details: o Click the plus icon in the log entry. The entry expands to display the details of the log entry.

5.7 Exporting Log Entries

To export the log entries of the currently selected profile:

1. Click Export All.

2. Enter a File name, location, a file type, and then click Save.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

5.8 Clearing Log Entries

To clear old log entries of the currently selected profile:

1. Click Clear. The Clear Log window opens.

2. Select a number and time unit (Weeks, Days, or Hours) from the drop-down list to clear the log of older entries and then click OK.

3. Also, you have the option to clear the log entries of all profiles older than the selected time automatically by selecting Clear log automatically (applies to all profiles)

Binary Tree recommends that the logs be set to clear automatically to prevent the accumulated data from becoming too large.

To clear all log entries of the currently selected profile:

1. Click Clear All. All log entries of the currently selected profile are cleared.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Section 6. Updating the Groups to Ignore List in SQL

By default, Directory Sync is configured with a list of typical AD and Exchange security groups that will not be synchronized. You can update the Groups to Ignore List in SQL by using either the SQL Server Management Studio

(SSMS) or the SQL Import and Export Data tool.

You may also choose to not synchronize any Security groups via the Group Filter, which will prevent all groups matching the criteria from being entered into SQL. This must be configured before the initial synchronization, or you will have to remove all the security groups from SQL and AD prior to using this option.

6.1 Default List of Groups in the Groups to Ignore List Members for

Active Directory Synchronization

The default list of groups in the Groups to Ignore List Members includes: o NT Authority o Dialup o Network o Batch o Interactive o Logon Session o Service o Anonymous o Proxy o Enterprise Domain Controllers o Principal Self o Authenticated Users o Restricted Code o Terminal Server Users o Remote Interactive Logon o This Organization o Local System o NT Authority o Administrator o Guest o KRBTGT o Domain Admins o Domain Users

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

o Domain Guests o Domain Computers o Cert Publishers o Schema Admins o Enterprise Admins o Group Policy Creator Owners o RAS and IAS Servers o Administrators o Users o Guests o Power Users o Account Operators o Server Operators o Print Operators o Backup Operators o Replicators o NTLM Authentication o SChannel Authentication o Digest Authentication o NT Service o Untrusted Mandatory Level o Delegated Setup o Discovery Management o Exchange All Hosted Organizations o Exchange Organization Administrators o Exchange Public Folder Administrators o Exchange Recipient Administrators o Exchange Servers o Exchange Trusted Subsystem o Exchange View-Only Administrators o Exchange Windows Permissions o ExchangeLegacyInterop o Hygiene Management o Organization Management o Public Folder Management o Recipient Management

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

o Records Management o Server Management o UM Management o View-Only Organization Management o Updating Groups to Ignore List in SQL o By default, Directory

6.2 Updating the Groups to Ignore List with the SQL Server

Management Studio (SSMS)

Perform the following steps from SSMS to add or remove groups from the Groups to Ignore List in SQL. This process is preferred if you have a small number of changes to make. Refer to Updating the Groups to Ignore List via the SQL

Import and Export Data Tool for larger updates.

To add or remove groups from the Groups to Ignore List in SQL:

1. Launch the SQL Server Management Studio.

2. Navigate to the BTCodex server and database, expand Tables, and then right click on the

dbo.Dirsync_GroupsToIgnore.

3. Select Edit Top 200 Rows from the list.

4. Add new entries at the bottom.

5. If you have more than 200 groups to ignore, you can increase the number of rows shown: a. Run the SQL Server Management Studio. b. Click Tools -> Options c. Select SQL Server Object Explorer. Now you should be able to see the Table and View options: o Value for Edit Top Rows Command o Value for Select Top Rows Command

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

d. Set the Values to 0 to edit and select all the records.

6. The table displays the Select All Rows and Edit All Rows options.

6.3 Updating the Groups to Ignore List with the SQL Import and

Export Tool

To use the SQL Import and Export Data tool to update the Groups to Ignore List in SQL:

1. Expand the Microsoft SQL Server 2008 R2 folder and select Import and Export Data (32-bit).

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

2. Select the data source from which you want to copy data, and then click Next.

3. Select the destination where data is to be copied.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

4. Select Copy data from one or more tables or views, and then click Next to continue.

5. Choose one or more tables and views to copy, and then click Edit Mappings.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

6. Select Append rows to the destination table and fill in the values in the Destination column, then click OK.

7. Select Run immediately and then click Finish.

6.4 Excluding Security Groups from Synchronization with the Group

Filter

Select the appropriate Profile and Source OU in the Directory Sync UI and double-click on Group Filter on the AD

Source tab.

Replace (objectClass=Group) with (objectClass=Group)(!groupType:=-2147483646) and click Save.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Binary Tree recommends that you use the Active Directory Users and Computers management console to test your filters to prevent Directory Synchronization from failing due to an invalid filter.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Appendix A: Supporting a Mixed Exchange 2003/

2007/2010/2013 Environment

Synchronizing Rooms from Exchange 2003 to Exchange 2010

Due to the differences in the management of Rooms between Exchange 2003 and Exchange 2010, a custom mapping is required for Rooms from an Exchange 2003 source to appear as a Room object in a target Exchange 2010 environment.

The following fields must appear in the target Room objects for them to display as Rooms.

Attribute

MSExchResourceDisplay

MSExchResourceMetaData

MSExchResourceSearchProperties

MSExchResourceDisplayType

MSExchResourceRecipientTypeDetails

Value

Room

Resource Type: Room

Room

The Room must be a mailbox –enabled object in the source AD and cannot be a Public Folder

Binary Tree does not recommend manually editing any attributes from the target directory. All updates should be from the authoritative source directory or via custom mapping

There must be an identifying attribute in the source object that is used to distinguish these objects as Exchange 2003

Rooms. For this example, we have set the extension Attribute1 to “btroom”.

To customize the mapping so that Exchange 2003 rooms appear as rooms in Exchange 2010:

1. Start SQL Management Studio.

2. Select Database, BTCodex, Tables, dbo.BT_ViewOverrides.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

3. Select Edit Top 200 Rows from the list.

4. Enter the following values: o BT_ViewOverrides_PK: Do not enter a value. This value will be populated automatically. o View: Enter either Groups for the BT_GroupsView or Person for the BT_PersonView. o FieldName: Enter the name of the field from the view that you want to override (TargetAddress,

BTCustom001, and so on) o FieldValue: Enter the SQL statement that is used to calculate the value for the field.

View Field Name

Person as msExchResourceDisplay

Person msExchResourceMetaData

Field Value

CASE WHEN P.msExchResourceDisplay IS NOT NULL THEN

P.msExchResourceDisplay ELSE (CASE P.Extension1 WHEN 'btroom'

THEN 'Room' ELSE NULL END) END

CASE WHEN P.msExchResourceMetaData IS NOT NULL THEN

P.msExchResourceMetaData ELSE (CASE P.Extension1 WHEN 'btroom'

THEN 'ResourceType:Room' ELSE NULL END) END

Person msExchResourceSearchProperties

CASE WHEN P.msExchResourceSearchProperties IS NOT NULL THEN

P.msExchResourceSearchProperties ELSE (CASE P.Extension1 WHEN

'btroom' THEN 'Room' ELSE NULL END) END

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

View Field Name

Person msExchRecipientDisplayType

Person msExchRecipientTypeDetails

Field Value

CASE WHEN P.msExchRecipientDisplayType IS NOT NULL THEN

P.msExchRecipientDisplayType ELSE (CASE P.Extension1 WHEN

'btroom' THEN '7' ELSE NULL END) END

CASE WHEN P.msExchRecipientTypeDetails IS NOT NULL THEN

P.msExchRecipientTypeDetails ELSE (CASE P.Extension1 WHEN 'btroom'

THEN '16' ELSE NULL END) END

5. If you insert, modify or delete a row from BT_ViewOverrides, you must execute the appropriate stored procedure in order for your changes to take effect.

6. If you delete a row from BT_ViewOverrides, the view will revert back to using the default values for the given field.

7. You can now synchronize Rooms from Exchange 2003 to Exchange 2010.

8. Once these rooms are in the target directory, go to the Exchange Management Console (EMC) in the target

2010 environment.

9. Expand the Organization Configuration folder, select Mailbox, and then select All Rooms.

10. Right click on All Rooms and then select Apply.

11. Click Next and then Finish to reapply the address list.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Appendix B: Additional Configuration Options

Changing the attribute used for "Created by Dirsync" or "Updated by Dirsync"

By default, the adminDescription attribute is stamped on objects on the Target that are created or updated by SMART

Directory Sync with "Created by Dirsync" or "Updated by Dirsync" to define which objects can be safely deleted from the Target. An app setting is available in the config file to allow you to define a different attribute/field for this purpose.

To use an attribute other than adminDescription, define a new DirSyncAttribute setting in the <appSettings> section of the config file. For example, the below setting will use adminDisplayName instead of adminDescription:

Warning: This must be configured before the initial sync.

. . .

. . .

</appSettings>

Setting msExchRecipientDisplayType and msExchRecipientTypeDetails Exchange attributes

A configuration option to allow you to set msExchRecipientDisplayType and msExchRecipientTypeDetails Exchange attributes based on the value of a configurable attribute is available.

The configuration option must defined in the <appSettings> section of the config file, as shown below. “Value=” should be contain the attribute to be used. (proxyAddresses shown below). If the value of the attribute is null, msExchRecipientDisplayType and msExchRecipientTypeDetails will be populated. See the list below for the values that will be populated.

</appSettings>

Mail Enabled Users in the source: o msExchRecipientDisplayType = 6 o msExchRecipientTypeDetails = 128

Room Mailbox in the source: o msExchRecipientDisplayType = 7 o msExchRecipientTypeDetails = 16

Resource Mailbox in the source: o msExchRecipientDisplayType = 8

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

o msExchRecipientTypeDetails = 32

Shared Mailbox in the source: o msExchRecipientDisplayType = 0 o msExchRecipientTypeDetails = 4

Appendix C: Using the User and Group LDAP filters

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Appendix C. Using the User and Group LDAP Filters

Active Directory provides a powerful way of retrieving data through the use LDAP filters. Directory Synchronization exposes two filters during the creation of a synchronization profile: User OU Filter and Group OU Filter whose defaults are (|(objectClass=Person)(objectClass=room))(!(objectClass=computer)) and (objectClass=Group), respectively. These filters are per organizational unit and apply to sub-OUs when the Sync Sub-OUs option is selected.

Modifying these filters requires a basic understanding of the attributes, their value representations, and their data types. LDAP filters support any number of options including filtering by date ranges, wildcards, and the use of bitmasks as in the userAccountControl property.

The use of the objectClass and objectCategory properties can greatly reduce the number of records retrieved resulting in improved performance. You may use other attributes to further restrict your results.

The following are common examples of queries and their LDAP query syntax. o Selecting users that are part of the ‘Accounting’ department: o (&(objectClass=User)(objectCategory=Person)(department=Accounting)) o Selecting mailbox-enabled users: o (&(objectClass=User)(objectCategory=Person)(homeMDB=*)) o Selecting mail-enabled users and contacts: o (|(&(objectClass=User)(objectCategory=Person)(!homeMDB=*))(objectClass=Contact)) o Selecting users created after January 1, 2011: o (&(objectClass=User)(objectCategory=Person)(whenCreated>=20110101000000.0Z)) o Selecting distribution lists: o (&(objectClass=Group)(groupType=2))

Binary Tree recommends that you use the Active Directory Users and Computers management console to test your filters to prevent Directory Synchronization from failing due to an invalid filter.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Appendix D: Default Mapping

The below table displays the default values of the AD Source to AD Target mapping table.

Source Field altRecipient assistant authOrig

C cn

Co codePage

Comment company countryCode deletedItemFlags delivContLength department departmentNumber description displayName division dLMemSubmitPerms dLMemRejectPerms employeeID employeeNumber employeeType

Internal Field

ForwardingAddress

Assistant

AuthOrig

CountryAbbreviation

CommonName

CountryName

CodePage

Comment

Company

CountryCode

DeletedItemFlags

DelivContLength

Department

DepartmentNumber

Description

DisplayName

Division

DLMemSubmitPerms

DLMemRejectPerms

EmployeeID

EmployeeNumber

EmployeeType

Target Field altRecipient authOrig

C cn

Co codePage

Comment company countryCode deletedItemFlags delivContLength department departmentNumber description displayName division dLMemSubmitPerms dLMemRejectPerms employeeID employeeNumber employeeType any any any any any any any any any any any any any any any any any any any any any any any any any any any any

So urc e

Ty pe

Tar get

Ty pe

Tar get

Typ e 2 any any any any

Comments any any any any any any any any any any any any

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Source Field extensionAttribute1 extensionAttribute10 extensionAttribute11 extensionAttribute12 extensionAttribute13 extensionAttribute14 extensionAttribute15 extensionAttribute2 extensionAttribute3

Internal Field

Extension1

Extension10

Extension11

Extension12

Extension13

Extension14

Extension15

Extension2

Extension3

Target Field extensionAttribute1 extensionAttribute10 extensionAttribute11 extensionAttribute12 extensionAttribute13 extensionAttribute14 extensionAttribute15 extensionAttribute2 extensionAttribute3

So urc e

Ty pe

Tar get

Ty pe

Tar get

Typ e 2 any any any any

Comments

These are

Exchange defined custom attributes.

These are

Exchange defined custom attributes. any any any any

These are

Exchange defined custom attributes.

These are

Exchange defined custom attributes. any any any any any any any any any any

These are

Exchange defined custom attributes.

These are

Exchange defined custom attributes.

These are

Exchange defined custom attributes.

These are

Exchange defined custom attributes.

These are

Exchange defined custom attributes.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Source Field extensionAttribute4 extensionAttribute5 extensionAttribute6 extensionAttribute7 extensionAttribute8 extensionAttribute9

Internal Field

Extension4

Extension5

Extension6

Extension7

Extension8

Extension9 facsimileTelephoneNumb er

OfficeFAXNumber generationQualifier givenName homePhone

HomePostalAddress

Suffix

FirstName

HomePhoneNumber

HomePostalAddress

Target Field extensionAttribute4 extensionAttribute5 extensionAttribute6 extensionAttribute7 extensionAttribute8 extensionAttribute9 facsimileTelephoneNumb er

So urc e

Ty pe

Tar get

Ty pe

Tar get

Typ e 2 any any any any

Comments

These are

Exchange defined custom attributes.

These are

Exchange defined custom attributes. any any any any

These are

Exchange defined custom attributes.

These are

Exchange defined custom attributes. any any any any

These are

Exchange defined custom attributes.

These are

Exchange defined custom attributes. any any generationQualifier any any givenName homePhone

HomePostalAddress any any any any any any

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Info initials

Source Field Internal Field

Info

Initials

Info initials

Target Field So urc e

Ty pe

Tar get

Ty pe

Tar get

Typ e 2

Comments any any any any internationalISDNNumber InternationalISDNNumber internationalISDNNumber any any internetEncoding internetEncoding internetEncoding any any ipPhone jpegPhoto l language legacyExchangeDN

IPPhone

JPEGPhoto

OfficeCity

Language

LegacyExchangeDN ipPhone jpegPhoto l language legacyExchangeDN any any any any any any any any any any Created using the source object's GUID as the CN. localeID mail mailNickname manager mAPIRecipient middleName

LocaleID

InternetAddress

PrimaryAlias

Manager

MAPIRecipient

MiddleName localeID mail mailNickname mAPIRecipient middleName any any any any any any any any any any any any

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

mobile

Source Field Internal Field

CellPhoneNumber mobile

Target Field So urc e

Ty pe

Tar get

Ty pe

Tar get

Typ e 2

Comments any any msDS-

PhoneticCompanyName msDSPhoneticCompanyN ame msDS-

PhoneticCompanyName any any any any msDS-

PhoneticDepartment msDS-

PhoneticDisplayName msDSPhoneticDepartmen t msDS-

PhoneticDepartment msDSPhoneticDisplayNa me msDS-

PhoneticDisplayName any any msDS-PhoneticFirstName msDSPhoneticFirstName msDS-PhoneticFirstName any any msDS-PhoneticLastName msDSPhoneticLastName msDS-PhoneticLastName any any msExchAddressBookFlags msExchAddressBookFlags msExchAddressBookFlags any any msExchALObjectVersion msExchALObjectVersion msExchALObjectVersion any any msExchArchiveGuid msExchArchiveGuid msExchArchiveGuid any any msExchArchivename msExchAssistantName msExchArchivename msExchArchivename any any msExchAssistantName msExchAssistantName any any msExchBlockedSendersH ash msExchBlockedSendersH ash msExchBlockedSendersH ash any any msExchBypassAudit msExchBypassAudit msExchBypassAudit any any msExchELCExpirySuspens ionEnd msExchELCExpirySuspens ionEnd msExchELCExpirySuspens ionEnd any any

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Source Field Internal Field Target Field So urc e

Ty pe

Tar get

Ty pe

Tar get

Typ e 2

Comments msExchELCExpirySuspens ionStart msExchELCExpirySuspens ionStart msExchELCExpirySuspens ionStart any any msExchELCMailboxFlags msExchELCMailboxFlags msExchELCMailboxFlags any any msExchExternalOOFOptio ns msExchExternalOOFOptio ns msExchExternalOOFOptio ns any any msExchHideFromAddress

Lists msExchHideFromAddress

Lists any any msExchMailboxAuditEnab le msExchMailboxAuditEnab le msExchMailboxAuditEnab le any any msExchMailboxAuditLog

AgeLimit msExchMailboxAuditLog

AgeLimit any any msExchMailboxGuid msExchMailboxGUID msExchMailboxGuid any any msExchMDBRulesQuota msExchMDBRulesQuota msExchMDBRulesQuota any any msExchMessageHygieneF lags msExchMessageHygieneF lags msExchMessageHygieneF lags any any msExchMessageHygieneS

CLDeleteThreshold msExchMessageHygieneS

CLDeleteThreshold any any msExchMessageHygieneS

CLJunkThreshold msExchMessageHygieneS

CLJunkThreshold any any msExchMessageHygieneS

CLQuarantineThreshold msExchMessageHygieneS

CLQuarantineThreshold any any

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Source Field Internal Field Target Field So urc e

Ty pe

Tar get

Ty pe

Tar get

Typ e 2

Comments msExchMessageHygieneS

CLRejectThreshold msExchMessageHygieneS

CLRejectThreshold any any msExchModerationFlags msExchModerationFlags msExchModerationFlags any any msExchPoliciesExcluded msExchPoliciesExcluded msExchPoliciesExcluded any any msExchPoliciesIncluded msExchPoliciesIncluded msExchPoliciesIncluded any any msExchProvisioningFlags msExchProvisioningFlags msExchProvisioningFlags any any msExchRecipientDisplayT ype msExchRecipientDisplayT ype msExchRecipientDisplayT ype any any msExchRecipientTypeDet ails msExchRecipientTypeDet ails msExchRecipientTypeDet ails any any

This mapping is ignored and msExchRecipie ntDisplayType is set to 6 when the profile is set to sync users as Mail-

Enabled Users or Disabled

Mail-Enabled

Users, or the profile is set to sync users “As-

Is” and the object in the source is

Mailbox-

Enabled.

This mapping is ignored and msExchRecipie ntTypeDetails is set to 128 when the profile is set to

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Source Field Internal Field Target Field So urc e

Ty pe

Tar get

Ty pe

Tar get

Typ e 2

Comments sync users as

Mail-Enabled

Users or

Disabled Mail-

Enabled Users, or the profile is set to sync users “As-Is” and the object in the source is

Mailbox-

Enabled. msExchRequireAuthToSe ndTo msExchRequireAuthToSe ndTo msExchRequireAuthToSe ndTo any any msExchResourceCapacity msExchResourceCapacity msExchResourceCapacity any any msExchResourceDisplay msExchResourceDisplay msExchResourceDisplay any any msExchResourceMetaDat a msExchResourceMetaDat a msExchResourceMetaDat a any any msExchResourceSearchPr operties msExchResourceSearchPr operties msExchResourceSearchPr operties any any msExchSafeRecipientsHas h msExchSafeRecipientsHas h msExchSafeRecipientsHas h any any msExchSafeSendersHash msExchSafeSendersHash msExchSafeSendersHash any any msExchTransportRecipien tSettingsFlags msExchTransportRecipien tSettingsFlags msExchTransportRecipien tSettingsFlags any any msExchUMDtmfMap msExchUMDtmfMap msExchUMDtmfMap any any

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

otherIpPhone otherMobile otherPager otherTelephone pager personalPager personalTitle

Photo

Source Field Internal Field Target Field So urc e

Ty pe

Tar get

Ty pe

Tar get

Typ e 2

Comments msExchUMSpokenName msExchUMSpokenName msExchUMSpokenName any any msExchUserCulture msExchUserCulture msExchUserCulture any any msExchVersion name msExchVersion

Name

msExchVersion name any any any any

O objectGUID

AdminDisplayName

O adminDisplayName any any any any otherFacsimileTelephone

Number

OtherFacsimileTelephone

Number otherFacsimileTelephone

Number any any otherHomePhone OtherHomePhone otherHomePhone any any

OtherIpPhone

OtherMobile

OtherPager

OtherTelephone

PagerNumber

PersonalPager

PersonalTitle

Photo otherIpPhone otherMobile otherPager otherTelephone pager personalPager personalTitle

Photo any any any any any any any any any any any any any any any any

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Source Field physicalDeliveryOfficeNa me pOPCharacterSet pOPContentFormat postalAddress postalCode postOfficeBox

Internal Field

Location

POPCharacterSet

POPContentFormat

PostalAddress

OfficeZip

PostOfficeBox

Target Field So urc e

Ty pe

Tar get

Ty pe

Tar get

Typ e 2

Comments physicalDeliveryOfficeNa me any any Important, particularly for printers. pOPCharacterSet any any pOPContentFormat postalAddress postalCode postOfficeBox any any any any any any any any preferredDeliveryMethod PreferredDeliveryMethod preferredDeliveryMethod any any primaryInternationalISDN

Number

PrimaryInternationalISDN

Number primaryInternationalISDN

Number any any primaryTelexNumber proxyAddresses

PrimaryTelexNumber

ProxyAddresses primaryTelexNumber any any any any ProxyAddresse s contains the

InternetAddres s as the primary SMTP, the legacyExchang eDN of both the source and target as X500 addresses, and any email policies from the target (if

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Source Field pwdLastSet roomNumber sAMAccountName

Internal Field

PwdLastSet

RoomNumber

SAMAccountName

Target Field roomNumber sAMAccountName

So urc e

Ty pe

Tar get

Ty pe

Tar get

Typ e 2

Comments enabled). any any any any The following restricted chars will be replaced with underscores:

, + " < > ; = / [ ] :

| * ? \ showInAdvancedViewOnl y

ShowInAdvancedViewOnl y showInAdvancedViewOnl y any any sn st street streetAddress

LastName

OfficeState

Street

OfficeStreetAddress sn st street streetAddress any any Sometimes used as surname. any any any any any any telephoneAssistant telephoneNumber

TelephoneAssistant

OfficePhoneNumber telephoneAssistant telephoneNumber any any any any terminalServer TerminalServer terminalServer any any textEncodedORAddress TextEncodedORAddress textEncodedORAddress any any

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Source Field thumbnailLogo thumbnailPhoto title unauthOrig url userCert userCertificate userPrincipalName userSMIMECertificate wWWHomePage managedBy groupType

Internal Field

ThumbnailLogo

ThumbnailPhoto

JobTitle

UnauthOrig

WebSite

UserCert

UserCertificate

UserPrincipalName

UserSMIMECertificate

WWWHomePage

ManagedBy thumbnailLogo thumbnailPhoto title unauthOrig url userCert userCertificate userPrincipalName userSMIMECertificate wWWHomePage

GroupType

Target Field groupType

So urc e

Ty pe

Tar get

Ty pe

Tar get

Typ e 2

Comments any any any any any any any any any any any any any any any any any any any any gro up gro up con tact gro up gro up

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Appendix E: Customizing Overrides

In SMART Directory Sync, an override is used to transform values in the target directory based upon a formula.

The formula language used is T-SQL, used in Microsoft’s SQL Server product line. A valid select statement in T-SQL would be Select (FirstName + LastName) from BT_Person. When adding an override you do not need to include a full

SQL select statement as portions of the SQL statement are generated for you. Specifically, you are not required to use the select or from commands in the override. It is only required to enter the columns that should be selected. To continue the example above, a valid override would only need to contain the value of FirstName + LastName.

To add a View Override:

1. From the Mapping tab, click Overrides. The View Overrides window appears.

2. Click Add. The Override dialog appears.

3. Select a Person or Groups from the View drop-down list.

4. Enter a Field Name for the new override. This must be a valid internal field name in SQL.

5. Enter a Field Value for the new override. This must be a correctly formatted SQL statement.

6. Enter Comments for the new override.

7. Click Save.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

8. Click Yes for the confirmation message.

When you save an override, SMART Directory Sync re-generates the Person or Groups view. It does this by dynamically generating a single SQL statement using the snippet of SQL code that is part of all overrides. The max size for this SQL statement is 8000 total characters. If many new overrides are added, this limit could be exceeded and an error when adding the overrides will occur. In addition to the default overrides, approximately 15-20 more Person and 20-25 Group overrides can be added before hitting the size limit.

To edit a mapping override:

1. From the Mapping tab, click Overrides. The View Overrides window appears.

2. Select an Override and click Edit. The Override dialog appears.

3. Edit the Field Value for the override. The View and Field Name cannot be edited.

4. Edit Comments for the override.

5. Click Save.

6. Click Yes for the confirmation message.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

To delete a mapping override:

1. From the Mapping tab, click Overrides. The View Overrides window appears.

2. Select an Override and click Delete.

3. Click Yes for the confirmation message.

Controlling actions with Overrides

SMART Directory Sync uses the TypeOfTransaction column from the BT_Person table, or the Operation column from the BT_Groups table to determine what action to perform on the target object. These may have overrides applied to them, to control what actions Directory Sync will take for an object. The below image shows an example of this kind of override.

Matching user accounts with Overrides

The values used for matching can have overrides applied to them. This is accomplished by setting up a new override using the field names MatchValue1, MatchValue2, MatchValue3 and MatchValue4. Each MatchValue1-4 corresponds the respective Source and Target pair on the matching tab.

These values are used for matching only. Values that get written to the target are based on the mappings, not the matching.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Example Overrides

Field Name Field Value

'@domino.contoso.com' ELSE 'SMTP:' +

TargetAddress CASE EntryType WHEN 'user' THEN 'SMTP:' + P.BTCustom020 + dbo.ReplaceDomain(InternetAddress,'domino.contoso.com') END

TargetAddress 'SMTP:' + dbo.UpdateInternetAddress(InternetAddress,'domino.')

TargetAddress ' 'SMTP:' + dbo.ReplaceDomain(InternetAddress,'domino.contoso.com')

Description

This formula will dynamically set the targetaddress value based on the

EntryType.

This formula will set the TargetAddress value based on the

InternetAddress and prefix the domain with the value specified, in this case "domino.".

This formula will set the TargetAddress value based on the

InternetAddress and replace the domain with the value specified, in this case

"domino.contoso.com

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Field Name

TargetAddress CASE WHEN InternetAddress LIKE '%@kodak.com' THEN 'smtp:' + dbo.UpdateInternetAddress(P.InternetAddress, 'domino.') WHEN

InternetAddress LIKE '%@knotes.contoso.com' THEN 'smtp:' + dbo.ReplaceDomain(P.InternetAddress, 'domino.contoso.com') ELSE

P.InternetAddress END

Field Value

CommonName CASE EntryType WHEN 'user' THEN 'do$$' + SourceDirectoryID WHEN

'sharedmail' THEN 'do$$' + SourceDirectoryID ELSE CommonName END

CommonName CASE WHEN LEN(CommonName) > 64 THEN

LTRIM(RTRIM(LEFT(CommonName,64))) ELSE CommonName END

Description

This formula will dynamically set the targetaddress value based on the existing

InternetAddress domain name value. If the first domain is found then the

TargetAddress will be set to one value, if the second domain is found another value will be used and if neither domain is found then the

TargetAddress will be set the same as the current

InternetAddress value.

This formula will dynamically set the

CommonName value based on the

EntryType.

This formula will limit the CommonName value to 64 characters if it exceeds that limit.

ProxyAddresse s

Company

CASE ProxyAddresses WHEN '' THEN 'smtp:' + dbo.ReplaceDomain(InternetAddress,'@contoso.mail.onmicrosoft.com;smt p:') + dbo.UpdateInternetAddress(InternetAddress,'domino.') ELSE

ProxyAddresses + ';smtp:' + dbo.ReplaceDomain(InternetAddress,'@contoso.mail.onmicrosoft.com;smt p:') + dbo.UpdateInternetAddress(InternetAddress,'domino.') END

This formula will set or append to the list of

ProxyAddresses values the coexistence routing addresses.

This example specifically is designed for Office 365.

LTRIM(RTRIM(LEFT(company, 50)))

BTCustom0XX "this is a string"

This formula will Trim, then limit the string value by 50 characters.

This formula will set any string value to the

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Field Name Field Value

BTCustom0XX REPLACE(InternetAddress,'@','.')

BTCustom0XX LEFT(InternetAddress,CHARINDEX('@',InternetAddress)-1)

Description any SQL field.

This formula will replace the '@' symbol with a period '.' to create a string like so.

(i.e. first.last.contoso.com)

This formula will extract the localpart of

InternetAddress.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Appendix F: Directory Sync Fields with Special

Processing

The below tables include fields with some kind of special processing in Directory Sync. Fields can be have the following characteristics:



Cannot be mapped



Can be mapped and have an override



May be explicitly ignored or changed by Directory Sync if object meets certain conditions, even if mapping and override exists



Actual attribute may be set via config file

Additional notes are available below for field marked with a *.

Writing Users to AD

Attributes that may be set by SMART Directory Sync regardless of mapping:

Field distinguishedName objectClass userPassword unicodePwd userAccountControl msExchRecipientDisplayType msExchRecipientTypeDetails msExchResourceDisplay msExchResourceSearchProperties msExchResourceMetaData proxyAddresses* showInAddressBook* targetAddress* msExchMasterAccountSid

•

Cannot be mapped

•

Can be mapped / have override

•

May be explicitly ignored

•

May be set with config file

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Field msExchPoliciesExcluded msExchPoliciesIncluded userAccountControl pwdLastSet adminDescription

Special processing if mapped:

Field Cannot be mapped mail assistant* manager* managedBy* altRecipient* authoring unauthOrig dLMemSubmitPerms dLMemRejectPerms sAMAccountName legacyExchangeDN* mailNickname

Cannot be mapped

•

Can be mapped / have override

•

May be explicitly ignored

•

May be set with config file

•

Can be mapped / have override

•

May be explicitly ignored

•

May be set with config file

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Never set:

Field objectGUID objectSid whenCreated whenChanged uSNChanged name cn

Cannot be mapped

•

Can be mapped / have override

May be explicitly ignored

May be set with config file

Writing Groups to AD

Attributes that may be set by SMART Directory Sync regardless of mapping:

Field objectClass msExchRecipientDisplayType msExchVersion proxyAddresses* showInAddressBook* targetAddress* msExchPoliciesExcluded msExchPoliciesIncluded adminDescription

Cannot be mapped

•

Can be mapped / have override

•

May be explicitly ignored

•

May be set with config file

•

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Special processing if mapped:

Field Cannot be mapped mail assistant* manager* managedBy* altRecipient* authOring unauthOrig dLMemSubmitPerms dLMemRejectPerms sAMAccountName legacyExchangeDN* groupType mailNickname

Never set:

Field objectGUID objectSid whenCreated whenChanged uSNChanged name cn

Cannot be mapped

•

Can be mapped / have override

•

May be explicitly ignored

•

May be set with config file

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

Special processing by Internal Field Name:

Field Cannot be mapped

Can be mapped / have override

DisplayName

PrimaryAlias

SAMAccountName

InternetAddress

Name

CommonName

•

May be explicitly ignored

May be set with config file

If this internal field name is mapped and value is empty, actual value comes from different internal field

•

Additional Notes

1. TargetDN – this column contains the distinguishedName of the target object to be created or the existing distinguishedName of a matched target object. If the object is created, the following values are used: a. Non-group objects from Domino sources use the following columns (or override values if specified) in order until a non-NULL value is found: i. CommonName ii. DisplayName iii. PrimaryAlias iv. FullName v. PrimaryFullName b. Groups from Domino sources use the following columns (or override values if specified) in order until a non-NULL value is found: i. DisplayName ii. Name iii. CommonName iv. PrimaryAlias c. Non-group objects from AD sources use the DN column (or override value if specified) to compute a target object DN. This preserves the sub-OU hierarchy the object may be in from the source. d. Groups from AD sources, use the OU column (or override value if specified) to compute a target object

DN. This preserves the sub-OU hierarchy the object may be in from the source.

2. LegacyExchangeDN – the legacyExchangeDN of the target object is computed by constructing a value relative to the target Exchange organization. No override value is available.

3. TargetAddress a. Uses override value from the TargetAddress column if one is specified.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

b. Otherwise uses the primary SMTP from the list of source proxy addresses. c. Or the InternetAddress from the source object. d. Or the UserPrincipalName from the source object.

4. ProxyAddresses a. Includes all values from the ProxyAddress column (or override value if specified) for the source object. b. Adds the InternetAddress from the source. Makes it the primary SMTP address. Makes all others secondary SMTP addresses. c. Add an X500 address pointing to the legacyExchangeDN of the source object. d. Add an X500 address pointing to the legacyExchangeDN of the target object. e. Applies any Exchange email address policies from the target Exchange organization, if the Apply email policies option is enabled. All new addresses are added as secondary SMTP addresses regardless of the policy rules.

5. ShowInAddressBook – unless hiding from GAL is enabled. No override column is available for this field. a. Rooms are added to the All Rooms address book, except for Exchange 2003 which doesn't have rooms or the All Rooms address book. b. Users are added to the All Users address book. c. Groups are added to the All Groups address book. d. All objects are added to the All Global Address Lists (GAL) address book.

6. Manager – all objects except Groups a. Uses the Manager column (or override value if specified) for the source object. b. Locates the referenced Manager in the target. c. If not found and a pending sync is available for the Manager, DirSync will immediately sync it to the target. d. If the referenced Manager is a reference to itself, the Manager on the target object will be set on the next sync.

7. ManagedBy – group objects only a. Uses the ManagedBy column (or override value if specified) for the source object. b. Follows the same process as Manager above.

8. Assistant – all objects a. Uses the Assistant column (or override value if specified) for the source object. b. Follows the same process as Manager above.

9. AltRecipient – This is not automatically reconciled by Directory Sync.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

About Binary Tree

Binary Tree is a singularly focused global provider of migration software and solutions for Lotus Notes, Microsoft

Exchange, Active Directory, and Windows Server environments. Since 1993, Binary Tree has enabled more than 6,000 customers to migrate more than 30 million email users, and facilitated some of the most complex migrations on the planet. Its software solutions are available for migrating from Exchange 2003/2007/2010/2013 and Lotus Notes to onpremises and online versions of Microsoft Exchange, as well as migrations of Active Directory and Windows Server environments. Binary Tree is a Microsoft Gold Partner, an IBM Advanced Business Partner, and is one of Microsoft’s preferred vendors for migrating to Microsoft Office 365. The Company is headquartered outside of New York City with offices in London, Paris, Stockholm and Sydney. For more information, visit us at www.binarytree.com

Binary Tree Social Media Resources

Binary Tree, the Binary Tree logo, the SMART Migration graphics, and any references to SMART Migration and Binary Tree’s soft ware products, are trademarks of Binary Tree, Inc. All other trademarks are the trademarks or registered trademarks of their respective rights holders.

SMART DIRECTORY SYNC 4.3.0.1 COMPREHENSIVE USER GUIDE FOR AD

MIGRATION/SYNCHRONIZATION AND EXCHANGE MIGRATION

হ্যালো! আমি একটি এআই চ্যাটবট যা বিশেষভাবে Binary Tree 4.3.0.1 SMART Directory Sync User Guide এর সাথে আপনাকে সহায়তা করার জন্য প্রশিক্ষিত। আমি পুঙ্খানুপুঙ্খভাবে নথিটি পর্যালোচনা করেছি এবং আপনার প্রয়োজনীয় সঠিক তথ্য সনাক্ত করতে বা স্পষ্ট এবং সহজ শর্তে সামগ্রী ব্যাখ্যা করতে সহায়তা করতে পারি। আপনি নির্দিষ্ট বৈশিষ্ট্য, সমস্যা সমাধানের পদক্ষেপ বা সাধারণ ব্যবহার সম্পর্কে নির্দেশিকা খুঁজছেন কিনা, নির্দ্বিধায় আপনার প্রশ্ন জিজ্ঞাসা করুন। আপনার উদ্বেগ বা চাহিদা সম্পর্কে আপনি যত বেশি বিবরণ দেবেন, আমি তত বেশি নির্ভুলভাবে এবং কার্যকরভাবে আপনাকে সহায়তা করতে পারি!

সহকারী টাইপ করছে

সহকারী কীবোর্ডের বাইরে। অনুগ্রহ করে পরে আবার চেষ্টা করুন।

সূচিপত্র

মনে হচ্ছে আপনি এমন একটি নথিতে পৌঁছেছেন যা একাধিক ভাষায় লেখা, যার মধ্যে একটি আপনার মাতৃভাষা নয়। আপনি আপনার পছন্দের ভাষা ছাড়া অন্য ভাষার পৃষ্ঠাগুলি সাময়িকভাবে লুকাতে নিম্নলিখিত লিঙ্কগুলি ব্যবহার করতে পারেন।

বিজ্ঞাপন

Comprehensive User Guide for AD

Migration/Synchronization and

Exchange Migration

Table of Contents

Section 1. Introduction

1.1 Purpose

1.2 Audience for AD Migration/Synchronization and Exchange

Migration

1.3 About SMART Directory Sync for AD Migration/Synchronization and Exchange Migration

Key Features and Functions

Section 2. Configuring AD Migration/Synchronization and Exchange Migration Synchronization Profiles

2.1 Applying a License

2.2 Adding an AD Migration/Synchronization Profile

2.3 Adding an Exchange Migration Synchronization Profile

2.4 Suspending and Activating a Profile

2.5 Removing a Profile

2.6 Resetting a Profile

Section 3. Running Sync Reports

3.1 Active Directory Sync Report

Overview

Running a Sync Report

Objects tab

Members tab

Object Summary tab

Members Summary tab

Profile tab

Source DCs tab

Target DCs tab

Section 4. Running Directory Sync

4.1 Manually Starting a Synchronization using a Sync Profile

4.2 Manually Starting a Synchronization Process using the Right-

Click Menu

4.3 Manually Starting a Synchronization Process from a Command

Line

Section 5. Using the SMART Directory Sync Log

Viewer

5.1 Searching Log Entries

5.2 Pausing a Log

5.3 Showing Log Entries for a Time Period

5.4 Filtering the Log

5.5 Grouping the Log by Column

5.6 Viewing Log Entry Details

5.7 Exporting Log Entries

5.8 Clearing Log Entries

Section 6. Updating the Groups to Ignore List in SQL

6.1 Default List of Groups in the Groups to Ignore List Members for

Active Directory Synchronization

6.2 Updating the Groups to Ignore List with the SQL Server

Management Studio (SSMS)

6.3 Updating the Groups to Ignore List with the SQL Import and

Export Tool

6.4 Excluding Security Groups from Synchronization with the Group

Filter

Appendix A: Supporting a Mixed Exchange 2003/

2007/2010/2013 Environment

Synchronizing Rooms from Exchange 2003 to Exchange 2010

Appendix B: Additional Configuration Options

Changing the attribute used for "Created by Dirsync" or "Updated by Dirsync"

Setting msExchRecipientDisplayType and msExchRecipientTypeDetails Exchange attributes

Appendix C. Using the User and Group LDAP Filters

Appendix D: Default Mapping

Appendix E: Customizing Overrides

Controlling actions with Overrides

Matching user accounts with Overrides

Example Overrides

Appendix F: Directory Sync Fields with Special

Processing

Writing Users to AD

Writing Groups to AD

Additional Notes

About Binary Tree

Binary Tree Social Media Resources

সম্পর্কিত

Binary Tree Directory Sync 4.5 User Guide: AI Chat & PDF Access

Directory Sync Pro 5.1 User Guide for AD Migration/Synchronization and Exchange Migration

Directory Sync Pro 5.1 User Guide for Domino-Active Directory Synchronization

Binary Tree SMART Directory Sync 5.0: AI Chat & PDF

SMART Active Directory Migrator 9.2 User Guide

Binary Tree Directory Sync Software: AI Chat & PDF

Dell Migration Manager 8.13 User Guide