Mapping Account Information when Migrating

As we look forward to Microsoft Exchange 2000 Server and to migrating our Exchange 5.5 deployments in that direction, perhaps one of the most challenging pieces of the puzzle is Windows 2000/Windows NT account migration and how properties are mapped between environments. The difficult part of the process is mapping account information stored in the NT SAM database and the mail account information stored in the Exchange 5.5 directory into Win2K Active Directory (AD). Although you can accomplish this process in several ways, the key is to understand which properties and attributes are mapped, their importance, and how they are used.

The SID from the NT SAM database is the key NT 4.0 user property. For Exchange 5.5, the key mailbox attribute is the distinguished name (DN). Other important mailbox attributes include alias and the NT security descriptor (which maps to the NT 4.0 SID).

A typical first step in an NT 4.0/Exchange 5.5 to Win2K/Exchange 2000 migration is to migrate the NT 4.0 accounts to Win2K AD. After you upgrade an NT 4.0 account domain to Win2K AD, the new Win2K account can have additional attributes such as the DN (note that in Win2K, the DN uses the Lightweight Directory Access Protocol—LDAP—conventions instead of the X.500 conventions Exchange 5.5 uses), SID, sIDHistory (available only in Win2K native mode), and the SAMAccountName. The username in NT 4.0 becomes the DN, and the SID is retained when an account is moved. When you create a new account in AD using a migration tool that uses the Microsoft ClonePrincipalAPI, the account receives a new SID, but the system updates the sIDHistory to reflect the old NT 4.0 SID from which the Win2K account originated. The SAMAccountName reflects the old NT 4.0 SAM account name. How the system uses and populates these properties depends on how and under what scenarios you perform the account migrations. Your migration scenario, Active Directory Connector (ADC) synchronization, and third-party migration tools (which all use Microsoft's ClonePrincipal API for account migration) affect whether these properties are used during the account migration process and how they are used.

Two additional properties—the legacyExchangeDN and the msExchHomeServerName—are required to map Win2K accounts back to their Exchange 5.5 mailboxes. The ADC populates the legacyExchangeDN and the msExchHomeServerName properties in AD. After the ADC updates these properties, users with accounts in Win2K AD can access their mailboxes on Exchange 5.5 servers.

Moving mailboxes during your Exchange 5.5 to Exchange 2000 migration is straightforward because you've already migrated the accounts to AD; you only need to update the accounts' msExchHomeServerName and homeMDB properties to reflect a new Exchange 2000 server where they have a mailbox. You typically accomplish this using the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in. By selecting the account and Exchange Tasks, you can move a mailbox from an Exchange 5.5 server to an Exchange 2000 server.

Obviously, the Exchange 2000 migration process is complex and has many other aspects that I don't address here: Property and attribute mapping is only one part. An online search shows Microsoft and other sources have substantial amounts of information about the migration process. Make sure you invest some time learning about the process before venturing down the path. Also, remember that how the migration occurs depends on the migration scenario and which tools you use.