CONTACTSYNC V7.3. Manual. NETsec. NETsec GmbH & Co.KG Schillingsstrasse 117 DE Düren. 18. June 2018

Transcription

1 CONTACTSYNC V7.3 Manual NETsec 18. June 2018 NETsec GmbH & Co.KG Schillingsstrasse 117 DE Düren

2 Introduction... 5 contactsync... 5 Global Address List (GAL) into mailboxes by using GALsync policies... 5 GALsync... 5 Recommendations (Do s and Don ts)... 6 Suggestions to test contactsync policies... 6 Schedule without overlaps... 6 Performance (Exchange Online)... 6 Licensing... 6 Trial license... 6 How to add a license... 7 How many objects are to be licensed?... 7 Quickstart: Global Address List (GAL) into mailboxes Prerequisites Install the software Create and run a contactsync policy Deployment Guide Introduction Exchange > Mailbox Contacts Exchange Online -> Mailbox Contacts Technical Guide System Requirements Prerequisites Service Account Mailbox Full access permissions for mailboxes (Mailbox contacts) Execution Policy (Exchange online) Some notes to the remote PowerShell management for Office 365 tenants Running contactsync policies via command line contactsync components Files

3 Policy GUI Policy Wizard Service Internal Marks NoContactSync (internal mark) NoMailboxSync (internal mark) Global Settings TAB Settings Status file directory Use LDAP over SSL (LDAPS) TAB Exchange Exchange On-Premise TAB Policies TAB Status Retain status information TAB Help Filter mailboxes NoMailboxSync (internal mark) Choose mailboxes (On-premise) Choose mailboxes (Exchange Online) Search mailboxes (On-premise) Search mailboxes (Exchange Online) Directory tab NoContactSync (internal mark) Choose (On-premise) Choose (Exchange Online) Search (On-premise) Search (Exchange Online) Special options for contactsync Exchange On-Premise Exchange Online

4 Maximum errors to transfer data file Minimum objects to transfer data file Include hidden objects (On-Premise only) Export MasteredOnPremise objects (Exchange Online only) Mark synchronized contacts as private Synchronize Picture (On-Premise) Object Filter Filter and Modify objects for import into mailboxes Choose (Mailbox contacts) Properties (Mailbox contacts) Status notification Schedule Service How to How to grant full access to the user mailboxes? Exchange Exchange 2013, 2016 and Exchange Online How to bulk assigns full access permissions to multiple user mailboxes Troubleshooting and Support Guide Issue with Exchange Online connection The Autodiscover service returned an error LegacyExchangeDN of the contactsync service account is in the old syntax. Please update this by r enabling the service account or create a new contactsync service account Could not load file or assembly 'netstandard, Version= , Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51' or one of its dependencies. The system cannot find the file specified Support: What to do when I notice an error / bug?

5 Introduction contactsync contactsync synchronizes the Global Address List (GAL) into users mailboxes, which are in the same environment. Mail-enabled objects of an on-premise Active Directory can be synchronized into on-premise Exchange mailboxes of the same forest and mail-enabled objects of an Office 365 tenant can be synchronized into Exchange Online mailboxes of the same Office 365 tenant. This document describes how to synchronize the Global Address List (GAL) into users mailboxes, which are in the same environment. Global Address List (GAL) into mailboxes by using GALsync policies A cross-forest synchronization from mail-enabled objects of an on-premise Active Directory into Exchange Online mailboxes of an Office 365 or mailenabled objects of an Office 365 tenant into on-premise Exchange mailboxes is only possible with two GALsync policies. One of the GALsync policies exports the mail-enabled objects from an on-premise Active Directory or from an Office 365 tenant and the second GALsync policy imports the exported objects as contacts into on-premise Exchange mailboxes or Exchange Online mailboxes. Please have a look in the GALSYNC GLOBAL ADDRESS LIST (GAL) INTO MAILBOXES BY USING GALSYNC POLICIES for further information. GALsync GALsync synchronizes the Global Address List (GAL) between different Exchange environments, which can be on-premise Exchange environments or Exchange Online of Office 365 tenants. Please have a look in the GALSYNC MANUAL for further information. MICROSOFT STOPPED SUPPORTING EXCHANGE 2007 ON THE 11TH APRIL AS MUCH AS WE WOULD LIKE TO KEEP COMPATIBILITY UP FOR ALL VERSIONS, WE CANNOT SUPPORT AN ENVIRONMENT, WHICH IS NO LONGER SUPPORTED BY THE MANUFACTURER. 5

6 Recommendations (Do s and Don ts) Suggestions to test contactsync policies We recommended to test contactsync before using with your production accounts. This way you will prevent any unwanted changes or impacts you might not have considered during setup. First use some test accounts and groups Then use only 1-5 real accounts Schedule without overlaps It is strongly recommended that you configure the scheduler in such a way, that policies do not overlap. Try the time for each policy will run by a manual execution. After that configure your schedules. Performance (Exchange Online) When using any Exchange Online related policy in contactsync, please be aware of the possibility of some lag. This is due Exchange Online being a remote environment, which contactsync connects to using Remote PowerShell. This puts contactsync inside any existing limitation Microsoft might apply to the connection. Licensing Trial license It is possible to run contactsync without license. Please note that in this case only up to 20 objects can be synchronized for up to 21 days. If you run contactsync as trial this is displayed in information bar at the bottom of the program window. If you have any licensing questions or queries, please feel free to contact our contactsync Sales Team by phone or via sales@netsec.de 6

7 How to add a license Click HELP and select ABOUT. contactsync will provide you with basic information about your current license status. To add a license, you press the ADD LICENSE button, and then select the license file you received. How many objects are to be licensed? Create a contactsync policy, choose the appropriate objects. Then you can count all of the objects which are valid for synchronization and would be synchronized during a run. This can help you choose for how many sync objects you need to license. 7

8 Quickstart: Global Address List (GAL) into mailboxes Here you test the basic steps for a successful first unidirectional synchronization. In this example, you synchronize the mail-enabled objects of the onpremise Active Directory forest into contacts folder of user s mailboxes, which are on the on-premise Exchange server in the same forest. 8

9 Or you synchronize the mail-enabled objects of the Office 365 tenant into contacts folder of user s mailboxes, which are on the Exchange Online in the same Office 365 tenant. 1 Prerequisites Your environment must be based on Exchange 2010 SP1 and higher or Exchange Online (Microsoft Office 365). MICROSOFT STOPPED SUPPORTING EXCHANGE 2007 ON THE 11TH APRIL AS MUCH AS WE WOULD LIKE TO KEEP COMPATIBILITY UP FOR ALL VERSIONS, WE CANNOT SUPPORT AN ENVIRONMENT WHICH IS NO LONGER SUPPORTED BY THE MANUFACTURER. The computer you want to install contactsync on Must be a member of the domain if your side is On-Premise. It should have a good bandwidth to the next DC/GC and an Exchange Server with CAS role. Can also be a standalone machine if your side is Exchange-Online. Should have a dual-core processor and 2GB RAM. Can be a client OS, e.g. Windows 7 Professional (64-Bit), for testing or a server OS, e.g. Windows 2008 R2 SP1 (64-Bit). Must be configured with.net Framework Must be configured with PowerShell 3.0 or higher. 9

10 Create a service account with an Exchange mailbox. On-Premise: Provide the user of the mailbox with administrative permissions on the machine you want to install contactsync on. Exchange-Online: The user of the mailbox must be member of the EXCHANGE ADMINISTRATOR role or GLOBAL ADMINISTRATOR role. contactsync must have direct access to the user mailbox via Exchange Web Services. NOTE: DIRECT ACCESS TO KIOSK USER MAILBOXES VIA EXCHANGE WEB SERVICES IS NOT PERMITTED. SEE AND US/exchangesvrdevelopment/thread/1758d5f8-be86-4dc9-b53c-d6eb38d2d7d2 Ensure that the mailbox is accessible (e.g. by Outlook Web Access), that the mailbox can send to and receive mails from the other organization and that incoming mails from the other organization do not get caught by your spam filter or firewall. NOTE: NEW CREATED EXCHANGE ONLINE ACCOUNTS NEED TO LOG ON AT LEAST ONE TIME TO RESET THEIR TEMPORARY PASSWORD. OTHERWISE REMOTE POWERSHELL WILL NOT WORK. If your side is On-Premise, make sure that you can logon with the configured service account. It is also required that the setup of contactsync can grant this account with local security permissions to LOG ON AS SERVICE. You may also add the service account to the local group REMOTE DESKTOP USERS. For testing purposes create some mailboxes and a group. Add the mailboxes as member to the group. The service account need the FULL ACCESS PERMISSIONS for the mailboxes, where you want to import into the mailbox contacts. Please have a look at the chapter How to grant full access to the user mailboxes? NOTE: IN A HYBRID EXCHANGE ENVIRONMENT YOU NEED TWO IMPORT POLICIES. ONE IMPORT POLICY, WHICH IMPORTS INTO THE MAILBOXES, WHICH ARE LOCATED ON AN ON-PREMISE EXCHANGE SERVER. THE OTHER IMPORT POLICY, WHICH IMPORTS INTO THE MAILBOXES, WHICH ARE LOCATED ON EXCHANGE ONLINE OF THE OFFICE 365 TENANT. 10

11 2 Install the software Login with the user you created before. Run setup. 11

12 Run contactsync the first time and configure a Service Account (SA) by taking the same account as you are logged in (On-Premise). If the setup detects that contactsync was installed on a standalone machine, the service account will be added automatically as LOCALSYSTEM. 12

13 Running contactsync you can check the service account configuration and your log-in account at bottom left corner. On-Premise Exchange Online In menu HELP select ABOUT and add your license. See also chapter LICENSING. On-Premise only: In menu OPTIONS select EXCHANGE. Configure the access to your Exchange Server. Click MANUAL SETTING and the SEARCH icon. Now contactsync tries to use autodiscover and displays the EXCHANGE WEB SERVICES URL it discovers. If you get an error message please insert the correct EXCHANGE WEB SERVICES URL for your environment. Leave the other option unclicked. Confirm the first configuration by pressing the SAVE button. 13

14 3 Create and run a contactsync policy Create a contactsync policy lead by the wizard Choose to SYNCHRONIZE DIRECTORY INFORMATION(GAL) INTO USERS MAILBOXES OF AN ON-PREMISE EXCHANGE ENVIRONMENT. or choose to SYNCHRONIZE DIRECTORY INFORMATION(GAL) INTO USERS MAILBOXES OF AN EXCHANGE ONLINE / OFFICE 365 TENANT. 14

15 If you are at Exchange Online then click on ADD to insert new credentials. Insert the username, password and address of an appropriate account in the Exchange Online (Microsoft Office 365). NOTE: MICROSOFT ALLOWS ONLY 3 POWERSHELL CONNECTION PER ACCOUNT TO EXCHANGE ONLINE (MICROSOFT OFFICE 365). 15

16 You can test the credentials. contactsync will only use the mailbox of the primary account to send and receive s. NOTE: ALL ACCOUNTS MUST BE FROM THE SAME EXCHANGE ONLINE (MICROSOFT OFFICE 365) TENANT Click NEXT 16

17 On-premise Exchange: The contactsync service account need the full access permission for each mailbox, where you want to import the mail-enabled objects as contacts. If you don t want give the contactsync service account the full access permission for each mailbox, you can insert a dedicated mailbox user, which has the full access permission for each mailbox. Exchange Online: The primary account for Exchange Online need the full access permission for each mailbox, where you want to import the mailenabled objects as contacts. If you don t want give the primary account for Exchange Online the full access permission for each mailbox, you can insert a dedicated mailbox user, which has the full access permission for each mailbox. Click NEXT 17

18 Choose the mailbox users, which should get the mail-enabled objects as contacts. NoMailboxSync (internal mark) If you do not want import into a special mailbox, you may insert the value NOMAILBOXSYNC in any of the custom attributes (on-premise: EXTENSIONATTRIBUTE1 - EXTENSIONATTRIBUTE15 or Exchange online: CUSTOMATTRIBUTE1 - CUSTOMATTRIBUTE15). This prevents contactsync from adding this mailbox to the list of mailboxes, which get directory objects into the contact folder. 18

19 Choose the mail-enabled objects, which should synchronize into the users mailboxes as contacts. NoContactSync (internal mark) If you do not want a special object to be exported, you may insert the value NOCONTACTSYNC in any of the custom attributes (on-premise: EXTENSIONATTRIBUTE1 - EXTENSIONATTRIBUTE15 or Exchange online: CUSTOMATTRIBUTE1 - CUSTOMATTRIBUTE15). This prevents contactsync from adding this object to the export list. 19

20 As directory information SEARCH for the group which you created for test purposes with some test-mailboxes and groups as member. Click APPLY and choose GROUP +ONLY MEMBERSHIP, click OK and NEXT. 20

21 CHOOSE a mailbox contact folder. CREATE a folder for the contacts and select it. Click NEXT. 21

22 Leave STATUS NOTIFICATION S unclicked and click NEXT. Leave SCHEDULE SERVICE unclicked and click NEXT. 22

23 In the GENERAL SECTION insert a name for the policy and click NEXT. After in SUMMARY SECTION all your configuration is validated click FINISH. 23

24 Execute the policy by clicking RUN while mouse focus is set to the policy name in the hierarchy tree on the left hand side. The OPERATION STATUS displays the progress. After execution click CLOSE. Now you should see the synchronized mail-enabled objects in the folder of the mailbox contacts. 24

25 Deployment Guide Introduction This chapter will help you to plan your contactsync installation. To simplify the description of each scenario below. You can create a limitless number of policies. Multiple policies must be scheduled for execution no concurrent executions are possible. Policies are kept in a queue and will be run sequentially. Exchange > Mailbox Contacts If your environment is based on Exchange 2010, 2013 or 2016 and you want to sync into a folder of mailbox contacts, which are located on the Exchange 2010, 2013 or 2016 please use contactsync to synchronize directory objects. You have to install an instance of contactsync on a domain member computer in Exchange 2010, 2013 or 2016 forest. NOTE: IN A HYBRID EXCHANGE ENVIRONMENT YOU NEED TWO CONTACTSYNC POLICIES. ONE CONTACTSYNC POLICY, WHICH IMPORTS INTO THE MAILBOXES, WHICH ARE LOCATED ON AN ON-PREMISE EXCHANGE SERVER. THE OTHER CONTACTSYNC POLICY, WHICH IMPORTS INTO THE MAILBOXES, WHICH ARE LOCATED ON EXCHANGE ONLINE OF THE OFFICE 365 TENANT. 25

26 Exchange Online -> Mailbox Contacts If your environment is based on Exchange Online and you want to sync into a folder of mailbox contacts, which are located on the Exchange Online please use contactsync to synchronize directory objects. To get access to an Exchange Online (cloud only) environment you can also use a standalone server. NOTE: IN A HYBRID EXCHANGE ENVIRONMENT YOU NEED TWO CONTACTSYNC POLICIES. ONE CONTACTSYNC POLICY, WHICH IMPORTS INTO THE MAILBOXES, WHICH ARE LOCATED ON AN ON-PREMISE EXCHANGE SERVER. THE OTHER CONTACTSYNC POLICY, WHICH IMPORTS INTO THE MAILBOXES, WHICH ARE LOCATED ON EXCHANGE ONLINE OF THE OFFICE 365 TENANT. You can also use the contactsync software on the machine you installed in Exchange 2010, 2013 or 2016 forest to access Exchange Online, so you can import the directory objects into a folder of mailbox contacts, which are located on the Exchange Online. But in this case, you need a mailbox user in the Office 365 tenant, which has the full access permission to the mailboxes, which are located on Exchange Online. 26

27 Technical Guide System Requirements Components Required OS (64Bit) Windows 2008 R2 SP1 Server Windows 2012 Server Windows 2012 R2 Server Windows 2016 In small environments or for testing purposes you can also install contactsync on a client computer running Windows 7 Professional or Windows 10 Professional. Hardware Processor: minimum dual core RAM: minimum 2GB Software.NET Framework PowerShell 3.0 or higher Recommendations Exchange On-Premise: We recommend to install contactsync on a member server within the domain (e.g. dedicated contactsync server, file server or backup server). The machine should be uncritical (e.g. may be restarted without complications). The contactsync server must have a high bandwidth connection to the DC/GC. Exchange Online: See recommendations for on-premise; but you can use a standalone computer. Supported Exchange Versions* Exchange 2010 SP1 and higher Exchange 2013 and higher Exchange 2016 and higher Exchange Online (Office 365) * MICROSOFT STOPPED SUPPORTING EXCHANGE 2007 ON THE 11TH APRIL AS MUCH AS WE WOULD LIKE TO KEEP COMPATIBILITY UP FOR ALL VERSIONS, WE CANNOT SUPPORT AN ENVIRONMENT WHICH IS NO LONGER SUPPORTED BY THE MANUFACTURER. Prerequisites Service Account If you run contactsync in the context of a domain then create a service account which will be owner of the contactsync service. The service account must be a domain user of the same domain, the contactsync server is member to. Make sure that the service account is member of the LOCAL ADMINISTRATORS group. The service account needs the local right to RUN AS A SERVICE (this right is added to the service account during the installation). Make sure you can logon as the service account. It is possible that the user requires membership in the group Remote Desktop Users. 27

28 In order to install contactsync you need administrative permission. Setup will also install the contactsync Scheduling Service on the computer you setup contactsync on. NOTE: WE STRONGLY RECOMMEND LOGGING ON AS THE SERVICE ACCOUNT TO RUN THE CONTACTSYNC GUI. IMPORTANT: IF YOU CONFIGURE THE LOGON INFORMATION FOR THE SERVICE ACCOUNT IN THE CONTACTSYNC GUI USING EXCHANGE ON-PREMISE, THEN ALWAYS USE THE FORMAT DOMAIN\USERNAME. If you run contactsync on a standalone machine (this is only valid in an Exchange Online cloud-only scenario) then no logon information is required because the contactsync service will be run as the LOCALSYSTEM account. Mailbox At the Exchange on-premise side create an Exchange Mailbox, which will run all contactsync policies from now on. If you are in a domain then this mailbox should be owned by the contactsync service account. The mailbox cannot be hidden from Exchange address lists. At the Exchange Online side create an Exchange Mailbox, which will be used from all contactsync policies. The mailbox user must be member of the EXCHANGE ADMINISTRATOR role or GLOBAL ADMINISTRATOR role. NOTE: BY DEFAULT, THE EXCHANGE ONLINE PASSWORD HAS TO BE CHANGED WITHIN 30 DAYS. TO ENSURE, THAT CONTACTSYNC WORKS PROPERLY, YOU HAVE TO CONFIGURE USER PASSWORDS TO NEVER EXPIRE. TO CONFIGURE YOUR PASSWORD PLEASE FOLLOW THE STEPS DESCRIBED IN THE FOLLOWING ARTICLE: 0f54736f-eb22-414c a f contactsync must have direct access to the user mailbox via Exchange Web Services. NOTE: DIRECT ACCESS TO KIOSK USER MAILBOXES VIA EXCHANGE WEB SERVICES IS NOT PERMITTED. SEE AND US/exchangesvrdevelopment/thread/1758d5f8-be86-4dc9-b53c-d6eb38d2d7d2 Ensure that the mailbox is accessible (e.g. by Outlook Web Access). Ensure that the mailbox can send to and receive mails from the other organization. Ensure that incoming mails from the other organization do not get caught by your spam filter or firewall. 28

29 Full access permissions for mailboxes (Mailbox contacts) A service account needs the FULL ACCESS PERMISSIONS for the mailboxes, where you want to import into the mailbox contacts. Please have a look at the chapter HOW TO GRANT FULL ACCESS TO THE USER MAILBOXES? NOTE: IN A HYBRID EXCHANGE ENVIRONMENT YOU NEED TWO IMPORT POLICIES. ONE IMPORT POLICY, WHICH IMPORTS INTO THE MAILBOXES, WHICH ARE LOCATED ON AN ON-PREMISE EXCHANGE SERVER. THE OTHER IMPORT POLICY, WHICH IMPORTS INTO THE MAILBOXES, WHICH ARE LOCATED ON EXCHANGE ONLINE OF THE OFFICE 365 TENANT. Execution Policy (Exchange online) If you configure a policy which needs the parameter EXECUTIONPOLICY to be set to REMOTESIGNED, a message is displayed requiring your confirmation. The reason for this is a security setting built into Windows PowerShell, called execution policy. Execution Policy determines how (or if) PowerShell runs scripts. By default, PowerShell s execution policy is set to Restricted; this means that scripts will not run. contactsync requires that scripts are allowed to execute. GET-EXECUTIONPOLICY SET-EXECUTIONPOLICY REMOTESIGNED Some notes to the remote PowerShell management for Office 365 tenants Since contactsync 7.2.0, contactsync has a redesigned remote PowerShell management for Office 365 tenants. contactsync will now try to reconnect broken remote PowerShell sessions to the Office 365 tenant during a policy run. If a PowerShell connection to the Office 365 tenant is broken, then contactsync will try to reconnect to the Office 365 tenant, but it may happen, that some data are not completely synchronized due to the broken connection. 29

30 In this case contactsync will try to complete it in the next synchronization run. In the worst case it can happened, that some existing contacts in the target mailboxes of the synchronization will be deleted and that after they are re-created NDR issues in the target environment can occur. Running contactsync policies via command line Start a contactsync policy with the following command: Syntax: <contactsync program folder>\netsec contactsync\ <CommonApplicationDataPath>\contactSync\policies\<policy file> Example: cd "C:\Program Files\NETsec contactsync\" NETsecPolicyExecuter.exe "C:\ProgramData\NETsec GmbH & Co. KG\contactSync\policies\policyname.xml" You can find the COMMONAPPLICATIONDATA path one level up from the log file folder which you can find on the STATUS tab. 30

31 contactsync components Files The executables are stored by default in C:\PROGRAM FILES\NETSEC CONTACTSYNC, but you may change this during setup routine. This folder will be removed if you uninstall the software. Files containing your configured policies, created encryption keys, log files and so on are placed in folder %PROGRAMDATA%\NETSEC GMBH & CO. KG\CONTACTSYNC. NOTE: THE FOLDER %PROGRAMDATA% USUALLY IS HIDDEN. YOU MAY ACTIVATE THE OPTION SHOW HIDDEN FILES, FOLDERS, AND DRIVES IN FOLDER OPTIONS OF THE WINDOWS EXPLORER. Policy Policies are the core logical component. A policy defines which data you want to share, (filter the objects of your own directory), to which mailboxes you want to send the data included in this policy, to which address you want to send an administrative report, at what times you want the policy to be executed automatically. GUI The Graphical User Interface is used to configure policies. You can also test and execute policies manually. NOTE: IF YOU RUN A POLICY USING THE GUI THE POLICY RUNS IN THE CONTEXT OF THE USER THAT IS LOGGED IN. THEREFORE IT IS RECOMMENDED TO LOG IN WITH THE SAME ACCOUNT WHICH IS CONFIGURED FOR THE CONTACTSYNC SERVICE. The GUI is executed as process named CONTACTSYNC.EXE. 31

32 Policy Wizard The contactsync Console also provides Wizards for simplifying the tasks of creating policies. The Wizards walk you through each step-in order to create a usable policy that you can run manually or scheduled. If you go through the wizard contactsync provides you with different information Indicates a positive validation Indicates that some conditions in this step have not been validated yet Feature is not used Indicates a configuration process Service The contactsync Service is only used to execute the scheduled policies. The contactsync Service checks once a minute if there are enabled policies to be executed. These policies will be added to the execution queue and run sequentially. The service is executed as a process named CONTACTSYNCSERVICE.EXE. Every scheduled policy runs in the context of the user that is used by the contactsync Service. 32

33 Internal Marks NoContactSync (internal mark) If you do not want a special object to be exported, you may insert the value NOCONTACTSYNC in any of the custom attributes (on-premise: EXTENSIONATTRIBUTE1 - EXTENSIONATTRIBUTE15 or Exchange online: CUSTOMATTRIBUTE1 - CUSTOMATTRIBUTE15). This prevents contactsync from adding this object to the export list. NoMailboxSync (internal mark) If you do not want to import into a special mailbox, you may insert the value NOMAILBOXSYNC in any of the custom attributes (on-premise: EXTENSIONATTRIBUTE1 - EXTENSIONATTRIBUTE15 or Exchange online: CUSTOMATTRIBUTE1 - CUSTOMATTRIBUTE15). This prevents contactsync from adding this mailbox to the list of mailboxes, which get directory objects into the contact folder. 33

34 Global Settings The Global Settings are available if you click the CONTACTSYNC node in the left hierarchy tree. The content pane now displays the TABs SETTINGS, EXCHANGE, POLICIES, STATUS and HELP. TAB Settings Here you can configure general settings used in all policies. Status file directory. contactsync stores the log files in the application data of the program for all users. If the log files are stored somewhere else the suitable directory path can be put down here. 34

35 Use LDAP over SSL (LDAPS) Use LDAP over SSL (LDAPS) to connect an on-premise Active Directory. If you have configured LDAP over SSL (LDAPS) in your on-premise Active Directory, contactsync can use LDAP over SSL (LDAPS) to communicate with your on-premise Active Directory. NOTE: THE ACTIVE DIRECTORY SCHEMA PARTITION IS ONLY READ USING LDAP. You can get more information about "LDAP over SSL (LDAPS)" in the Microsoft TechNet Wiki article LDAP over SSL (LDAPS) Certificate You can check if LDAP over SSL (LDAPS) works at your environment/machine with Microsoft ldp.exe tool. TAB Exchange Here you can configure general Exchange settings used in all policies Exchange On-Premise If you work with Exchange On-Premise you can choose USE AUTODISCOVER to find the EXCHANGE WEB SERVICE (EWS). If Autodiscover does not work you may set the value for EXCHANGE WEB SERVICES (EWS) manually. If you click the SEARCH icon then contactsync tries to discover the Autodiscover settings. 35

36 TAB Policies The POLICIES tab lists all existing contactsync policies. Select a listed policy to see or modify configuration. After initial setup, if there is no policy created yet, so this list is empty. TAB Status The STATUS tab shows quick reports about the status of reports that were executed during the log retention timespan. 36

37 For support purposes you may export the status files (see menu ACTION EXPORT STATUS). NOTE: IF A POLICY JUST IS RUNNING ACCESS TO THE STATUS FILE MAY NOT BE POSSIBLE. THE STATUS FILE WILL BE DISPLAYED AT THE TOP OF THE LIST AND IS INDICATED WITH ERROR. Retain status information Here you can configure how long status information (log files) is stored on your machine. Logs older than the specified number of days will be deleted. You will find a link to the folder where the log files are stored. Please keep in mind that windows explorer usually hides this folder by default. If you do not see this link, please open the window symbol at the bottom on the right. TAB Help The HELP tab provides you with a hyperlink for downloading the latest manual as well as mail-addresses and phone numbers for support and sales. 37

38 Filter mailboxes In the Mailboxes TAB of contactsync policies for mailbox contacts you select the directory objects, which have mailbox objects. Search scope is a single object type all over the domain or selected organizational units in the local domain. You may also remove a selected entry from the list. NoMailboxSync (internal mark) If you do not want import into a special mailbox, you may insert the value NOMAILBOXSYNC in any of the custom attributes (on-premise: EXTENSIONATTRIBUTE1 - EXTENSIONATTRIBUTE15 or Exchange online: CUSTOMATTRIBUTE1 - CUSTOMATTRIBUTE15). This prevents contactsync from adding this mailbox to the list of mailboxes, which get directory objects into the contact folder. Choose mailboxes (On-premise) Here you may tick a dedicated Organizational Unit in the listed domains. An active directory tree with all domains and organizational units will be listed. In forests with multiple domains all domains are displayed. 38

39 Group Option Only this OU All mailbox objects included in the selected OU will be recognized for synchronization at runtime. Only Sub-OUs All mailbox objects included in one of the sub-ous of the selected OU will be recognized for synchronization at runtime. OU + Sub-OUs All mailbox objects included in a selected OU and all nested OUs will be recognized for synchronization at runtime. Include group memberships All mailbox objects, which are members of a group, will be recognized for synchronization at runtime, if the group is in a selected OU. Include nested groups + memberships Nested groups and their members will be also resolved for synchronization at runtime. 39

40 Exportable RecipientTypeDetails contactsync synchronizes objects which have one of the RECPIENTTYPEDETAILS set in the MSEXCHRECIPIENTTYPEDETAILS / RECIPIENTTYPEDETAILS property or the MSEXCHRECIPIENTTYPEDETAILS / RECIPIENTTYPEDETAILS property has not been set. The list of RECPIENTTYPEDETAILS can be modified with Add/Remove RecipientTypeDetails. NOTE: IN THE CASE OF RECIPIENTTYPEDETAILS, THAT ARE NOT PRESENT IN THE EXPORTABLE RECIPIENTTYPEDETAILS LIST BY DEFAULT, CONTACTSYNC DOES NOT CHECK WHETHER THEY ARE PRESENT OR USEFUL IN YOUR ENVIRONMENT. WE LEAVE THE VERIFICATION TO THE RESPONSIBLE ADMINISTRATOR TO SUPPORT AS MANY SCENARIOS AS POSSIBLE. A DISADVANTAGE IS THAT THE ADMINISTRATOR CAN CONFIGURE NONSENSE. 40

41 Choose mailboxes (Exchange Online) Here you may pick all USERMAILBOX objects. 41

42 Exportable RecipientTypeDetails contactsync synchronizes objects which have one of the RECPIENTTYPEDETAILS set in the MSEXCHRECIPIENTTYPEDETAILS / RECIPIENTTYPEDETAILS property or the MSEXCHRECIPIENTTYPEDETAILS / RECIPIENTTYPEDETAILS property has not been set. The list of RECPIENTTYPEDETAILS can be modified with Add/Remove RecipientTypeDetails. NOTE: IN THE CASE OF RECIPIENTTYPEDETAILS, THAT ARE NOT PRESENT IN THE EXPORTABLE RECIPIENTTYPEDETAILS LIST BY DEFAULT, CONTACTSYNC DOES NOT CHECK WHETHER THEY ARE PRESENT OR USEFUL IN YOUR ENVIRONMENT. WE LEAVE THE VERIFICATION TO THE RESPONSIBLE ADMINISTRATOR TO SUPPORT AS MANY SCENARIOS AS POSSIBLE. A DISADVANTAGE IS THAT THE ADMINISTRATOR CAN CONFIGURE NONSENSE. 42

43 Search mailboxes (On-premise) You can search an object by inserting an expression. Uncheck all object types you do not want to have as a result. NOTE: THE SCOPE OF THE QUERY IS THE FOREST. The result listed contains all objects found. Select certain or all objects to be gathered for import and press Apply. With * you can find all objects which you want to have as a result. User You can search for user objects with a mailbox and select dedicated mailboxes for import matching the inserted expression. RECOMMENDATION: SELECT DEDICATED MAILBOX USERS ONLY IF YOU ARE SURE THEY WILL NEVER BE DELETED FROM ACTIVE DIRECTORY. CONSIDER TO TAKE OBJECTS WITH DYNAMIC MEMBERS AS OUS, GROUPS ETC. Container You can search for container objects to get all objects with a mailbox in this container matching the inserted expression. 43

44 OU You can search for Organizational Units to get all objects with a mailbox in this OU matching the inserted expression. Dynamic Distribution Group DYNAMIC DISTRIBUTION GROUP (formerly QUERY-BASED GROUP) provides a type of Distribution Group with a flexible method to dynamically define the membership to this type of group. It is not a static membership like regular groups. Search for DYNAMIC DISTRIBUTION GROUPS matching the inserted expression and select if you want to get all members with a mailbox of this group. Groups Search for LOCAL, GLOBAL and UNIVERSAL groups of type SECURITY GROUP or DISTRIBUTION GROUP. If you check SETTING FOR ALL GROUPS the configuration will be applied to all listed and selected groups. Otherwise you will be asked for every selected group. 44

45 Search mailboxes (Exchange Online) Here you may pick either all objects or specify a filter by ticking recipient types you want to choose. With * you can find all objects which you want to have as a result. For example, you tick only MAILUNIVERSALDISTRIBUTIONGROUP and you will have all MailUniversalDistributionGroups as a result. The result listed contains all objects found. Select certain or all objects to be gathered for import and press APPLY. It is very important that you change this option if you want to get more than 500 objects. You can limit the results which you want to be get. NOTE: THE DEFAULT 500 IS SET TO PREVENT YOU FROM A LONG-TIME SEARCH. IF YOUR RESULT IS LARGER THAN THE GIVEN VALUE, THE NOT LISTED OBJECTS ARE NOT INCLUDED IN THE POLICY! 45

46 Directory tab In the Directory tab of contactsync policies for mailbox contacts you select mail-enabled objects, which will synchronize as contacts into user s mailboxes. You may also remove a selected entry from the list. NoContactSync (internal mark) If you do not want a special object to be exported, you may insert the value NOCONTACTSYNC in any of the custom attributes (on-premise: EXTENSIONATTRIBUTE1 - EXTENSIONATTRIBUTE15 or Exchange online: CUSTOMATTRIBUTE1 - CUSTOMATTRIBUTE15). This prevents contactsync from adding this object to the export list. 46

47 Choose (On-premise) Here you may tick a dedicated Organizational Unit in the listed domains. An active directory tree with all domains and organizational units will be listed. All mail-enabled objects (users, contacts and groups) included in a selected OU (and all nested OUs) will be recognized for import at runtime. In forests with multiple domains all domains are displayed. 47

48 Group Option Only this OU All mail-enabled objects, included in the selected OU will be recognized for synchronization at runtime. Only Sub-OUs All mail-enabled objects included in one of the sub-ous of the selected OU will be recognized for synchronization at runtime. OU + Sub-OUs All mail-enabled objects included in a selected OU and all nested OUs will be recognized for synchronization at runtime. Include group memberships All mail-enabled objects, which are members of a group, will be recognized for synchronization at runtime, if the group is in a selected OU. Include nested groups + memberships Nested groups and their members will be also resolved for synchronization at runtime. 48

49 Exportable RecipientTypeDetails contactsync synchronizes objects which have one of the RECPIENTTYPEDETAILS set in the MSEXCHRECIPIENTTYPEDETAILS / RECIPIENTTYPEDETAILS property or the MSEXCHRECIPIENTTYPEDETAILS / RECIPIENTTYPEDETAILS property has not been set. The list of RECPIENTTYPEDETAILS can be modified with Add/Remove RecipientTypeDetails. NOTE: IN THE CASE OF RECIPIENTTYPEDETAILS, THAT ARE NOT PRESENT IN THE EXPORTABLE RECIPIENTTYPEDETAILS LIST BY DEFAULT, CONTACTSYNC DOES NOT CHECK WHETHER THEY ARE PRESENT OR USEFUL IN YOUR ENVIRONMENT. WE LEAVE THE VERIFICATION TO THE RESPONSIBLE ADMINISTRATOR TO SUPPORT AS MANY SCENARIOS AS POSSIBLE. A DISADVANTAGE IS THAT THE ADMINISTRATOR CAN CONFIGURE NONSENSE. 49

50 Add/Remove RecipientTypeDetails Show a dialog, where you can modify the list of RECIPIENTTYPEDETAILS, which are allow for synchronization. NOTE: IF THE MSEXCHRECIPIENTTYPEDETAILS / RECIPIENTTYPEDETAILS PROPERTY IS NOT SET, THE OBJECT WILL BE SYNCHRONIZED. 50

51 Add value for export contactsync adds a value to a property during the synchronization. 51

52 Choose (Exchange Online) Here you may tick either all objects or specify a filter by ticking recipient types you want to choose. After that you define the list of RECIPIENTTYPEDETAILS for each recipient type, which will be recognized for synchronization at runtime. 52

53 Search (On-premise) You can search an object by inserting an expression. Uncheck all object types you do not want to have as a result. NOTE: THE SCOPE OF THE QUERY IS THE FOREST. The result listed contains all objects found. Select certain or all objects to be gathered for import and press Apply. With * you can find all objects which you want to have as a result. 53

54 Search (Exchange Online) Here you may tick either all objects or specify a filter by choosing recipient types you want to choose. With * you can find all objects which you want to have as a result. For example, you check only MAILUNIVERSALDISTRIBUTIONGROUP and you will have all MAILUNIVERSALDISTRIBUTIONGROUPS as a result. The result listed contains all objects found. Select certain or all objects to be gathered for import and press APPLY. It is very important that you change this option if you want to get more than 500 objects. You can limit the results which you want to be get. NOTE: THE DEFAULT 500 IS SET TO PREVENT YOU FROM A LONG-TIME SEARCH. IF YOUR RESULT IS LARGER THAN THE GIVEN VALUE, THE NOT LISTED OBJECTS ARE NOT INCLUDED IN THE POLICY! 54

55 Group Option Only group Synchronize the selected group object. Only Membership Synchronize the members of the selected group object Group + Membership Synchronize the group object and the members. Include nested groups Synchronize also the nested group objects and the members. 55

56 Exportable RecipientTypeDetails contactsync synchronizes objects which have one of the RECPIENTTYPEDETAILS set in the MSEXCHRECIPIENTTYPEDETAILS / RECIPIENTTYPEDETAILS property or the MSEXCHRECIPIENTTYPEDETAILS / RECIPIENTTYPEDETAILS property has not been set. The list of RECPIENTTYPEDETAILS can be modified with Add/Remove RecipientTypeDetails. NOTE: IN THE CASE OF RECIPIENTTYPEDETAILS, THAT ARE NOT PRESENT IN THE EXPORTABLE RECIPIENTTYPEDETAILS LIST BY DEFAULT, CONTACTSYNC DOES NOT CHECK WHETHER THEY ARE PRESENT OR USEFUL IN YOUR ENVIRONMENT. WE LEAVE THE VERIFICATION TO THE RESPONSIBLE ADMINISTRATOR TO SUPPORT AS MANY SCENARIOS AS POSSIBLE. A DISADVANTAGE IS THAT THE ADMINISTRATOR CAN CONFIGURE NONSENSE. 56

57 Add value for export contactsync adds a value to a property during the synchronization. 57

58 Special options for contactsync You can configure some optional SETTINGS on the DIRECTORY tab Exchange On-Premise 58

59 Exchange Online 59

60 Maximum errors to transfer data file In the DIRECTORY SETTINGS of a contactsync policy you can set a limit how many errors may occur when creating a data file before importing. If this limit of errors is exceeded, the effected data file will not be imported into the mailboxes. Minimum objects to transfer data file In the DIRECTORY SETTINGS of a contactsync policy you can define a minimum number of objects to be written to the data file before importing into the mailboxes. As long as the data file contains less objects it will not be imported into the mailboxes. For example, if you expect to export over 1000 objects, you can set a minimum of number of objects to Assuming that a network error occurs at runtime and contactsync identifies only 600 objects for export (because of unavailability of your domain controller). The data file will not be importing into the mailboxes. Otherwise, in the mailboxes the missing number of contacts would have been deleted even though they still exist in the environment. Include hidden objects (On-Premise only) If this option in the DIRECTORY SETTINGS of a contactsync policy is selected the objects, which are hidden from the GAL, are also synchronized. Export MasteredOnPremise objects (Exchange Online only) Allow you to export objects from Exchange Online (Office 365), which are synchronized with Microsoft Directory Synchronization tool. Microsoft Directory synchronization allows identities to be mastered on-premises and all updates to that identity are synchronized to Office 365. NOTE: BY DEFAULT CONTACTSYNC EXPORTS ONLY OBJECTS FROM EXCHANGE ONLINE (OFFICE365) WHICH ARE NOT STAMPED WITH MASTEREDONPREMISE. Mark synchronized contacts as private Allow you to mark the imported contacts as "private" in the user s mailboxes. Private contacts are not visible to other people, if the Microsoft Exchange account contacts are shared. NOTE: A PERSON WITH DELEGATE ACCESS OR PERMISSION TO READ YOUR SHARED FOLDERS COULD VIEW THE CONTENTS OF YOUR PRIVATE CONTACTS AND EVENTS BY USING OTHER APPLICATIONS. 60

61 Synchronize Picture (On-Premise) If this option in the DIRECTORY SETTINGS of a contactsync policy is selected the user s photos stored in the source directory are exported as well. Photos usually are stored in attribute THUMBNAILPHOTO. This option is only available in an on-premise environment. NOTE: IMPORTING THUMBNAILPHOTO INTO MAILBOXES IS VERY SLOWLY. THE EXCHANGE ENVIRONMENT NEEDS SOME DAYS TO UPDATE THE THUMBNAILPHOTO OF THE IMPORTED CONTACTS IN THE MAILBOXES, BEFORE YOU CAN SEE THE THUMBNAILPHOTO IN THE OUTLOOK CLIENTS. Object Filter Exclude all objects of the synchronization, which has one of the conditions. This feature allows you to exclude objects from the synchronize process. If you enable this feature inside your policy configuration dialog, you may add conditions containing a name of the property of which value is compared to the given value using your chosen comparison operator. During an export every object will be analyzed, if one or more properties matches this conditions. If at least one condition is fulfilled, the object will neither be synchronized." 61

62 Filter and Modify objects for import into mailboxes Configure all mailbox contact folder settings. Choose (Mailbox contacts) Add a new folder, where you want to store the imported directory information in and select it. Please select a folder for contact synchronization. All folders displayed by this control are for selecting purpose. Adding and deleting folders inside this dialog will not result in physically removing or adding this folder inside a mailbox. By selecting a folder this folder will be used on target mailboxes as folder to be filled with contacts. If the chosen folder does not exist in a target mailbox, this folder will be created during the next import. Selected Folder The selected folder will be used as target folder inside mailboxes during imports so that contacts will only be created inside this folder. 62

63 Allow synchronization into the well-known contact folder of the mailboxes. This option allows contactsync to create and synchronize the contacts into the well-known contact folder of the mailboxes. Please be careful with this option because it allows you to directly change and delete contacts that your employees have created. This could also confuse some of your employees. We recommend to create and synchronize an additional contact for each existing contact which was not created by contactsync. Do not touch untagged contacts, these contacts will not be synchronized All existing contacts will not be touched, unless they were created by contactsync. contactsync does not create and synchronize a contact if there is already an existing contact which was not created by contactsync. Synchronize untagged contacts with contactsync Please be very careful with this option. All existing contacts are synchronized, even if they were not created by contactsync. This means that if contacts have been created by your employees below the selected contact folder, contactsync will also synchronize and possibly delete them, which could cause your employees to lose information. Synchronize an additional contact for each untagged contact contactsync creates and synchronizes an additional contact for each existing contact which was not created by contactsync. 63

64 Create folder You can create a new folder, into which contactsync creates and synchronizes the contacts. This option gives you the possibility to separate the contacts, which have been created by your employees, from the contacts, which have been created by contactsync. Please keep in mind that the name of the folder should be unique and should not exist in the mailbox of your employees, otherwise contactsync will use the existing folder with the same name below the well-known contact folder of the mailbox for the synchronization. RECOMMENDATION: THE CONTACTSYNC SERVICE ACCOUNT CAN ONLY CREATE A SUB FOLDER FOR IMPORT, IF THE CONTACTSYNC SERVICE ACCOUNT HAS FULL ACCESS PERMISSION TO ALL MAILBOXES, WHICH SHOULD GET THE DIRECTORY INFORMATION. PLEASE GRANT FULL ACCESS TO THE USER MAILBOXES FOR THE CONACTSYNC SERVICE ACCOUNT. PLEASE HAVE A LOOK AT THE CHAPTER HOW TO GRANT FULL ACCESS TO THE USER MAILBOXES? Remove folder This option removes a folder inside this dialog but will not remove a folder inside a mailbox. Please select the folder, which you want to remove. 64

65 Properties (Mailbox contacts) Modify the values for the contactsync policy. The modified objects are prioritized during the import. Usually in your import list, there are different classes of objects (e.g. USER, CONTACT and GROUP). Because these classes have different attributes rules are apply related to the object class. E.g. the attribute FILEAS, DISPLAYNAME the first rule displayed in the screenshot will be apply only to users and contacts, because a group does not have an attribute GIVENNAME. The property INITIALS can be ignored for all object classes, because you can see the imported value in the Outlook clients. Property to modify These attributes can be modified before import: CompanyName, Department, Body, FileAs, BuisnessFax, GivenName, HomePhone, Initials, BuisnessPhone, BuisnessAddressCity, MobilePhone, Pager, OfficeLocation, BuisnessAddressPostalCode, Surnname, BuissnessAddressState, BuissnessAddressStreet, PrimaryPhone, JobTitle, BuisnessHomePage NOTE: SOME PROPERTY ARE NOT SHOWN IN OUTLOOK, E.G. INITIALS. 65

66 We support this matrix to transform the property between Exchange On- Premise / Exchange Online and the Outlook Contact: Active Directory (Exchange On-Premise) C Active Directory (Exchange Online) Outlook Contact (Exchange Mailbox) BusinessAddressCountryOrRegion Company Company CompanyName Department Department Department Description Body DisplayName DisplayName FileAs FacsimileTelephoneNumber Fax BusinessFax GivenName FirstName GivenName HomePhone HomePhone HomePhone Initials Initials L City BusinessAddressCity Mail Address3 Mobile MobilePhone MobilePhone OtherFacsimileTelephone Number IpPhone OtherFax OtherFax BusinessPhone2 OtherMobile CarPhone OtherTelephone OtherTelephone OtherTelephone Pager Pager Pager PhysicalDeliveryOfficeName Office OfficeLocation PostalCode PostalCode BusinessAddressPostalCode ProxyAddresses (primary SMTP) Addresses (primary SMTP) Address2 Sn LastName Surname St StateOrProvince BusinessAddressState StreetAddress StreetAddress BusinessAddressStreet TargetAddress External Address Address1 TelephoneNumber Phone BusinessPhone ThumbnailPhoto Photo Title Title JobTitle WWWHomePage WebPage BusinessHomePage 66

67 Add Value You can add a text to a property. Choose the property that you want to add a value to, and then choose the option ADD VALUE. You then have the option to add your value before the property (PREFIX) or after it (SUFFIX). 67

68 Find and Replace You can replace a specific string with a new value. Choose the property, select FIND AND REPLACE. In the find textbox insert the text which you wish to replace and in the replace textbox insert the new text. 68

69 Build Property You can create values by concatenating other property values. Choose the property and select the option BUILD PROPERTY. In the textbox BUILD PROPERTY, add a string, how the property value should be built. Via the ADD PROPERTY button, you can choose which properties are used. For Example, you want to generate the property, FILEAS from the last name, and first name comma separated. Choose the property SURNAME and the property GIVENNAME and insert a comma and space between them in the textbox BUILD PROPERTY. Thereafter, all values in property FILEAS will be created from a comma separated SURNAME and GIVENNAME. Please keep in mind, that only users and contacts have given name and surname, so the rule should be only valid for objects, which are users or contacts in the on-premise environment or Office 365 tenant. 69

70 Ignore this Property If you do not want to import a specific property, then you can select IGNORE THIS PROPERTY. NOTE: VALUES WHICH ARE ALREADY ASSIGNED TO THE OBJECTS PROPERTY WILL NOT BE MODIFIED BY CONTACTSYNC. TIP: YOU EXPORT A PROPERTY AND YOU WANT TO IMPORT A DIFFERENT PROPERTY IN THE TARGET ENVIRONMENT. BY COMBINING THE OPTIONS BUILD PROPERTY AND IGNORE THIS PROPERTY YOU CAN EITHER COPY OR MOVE A PROPERTY VALUE TO A DIFFERENT PROPERTY. Copy Property You can copy a property by choosing the end property and selecting the option BUILD PROPERTY. Then choose the property you wish to copy via the ADD PROPERTY dialog. Add the rule with the button ADD. Move Property You can move a property by doing the following: 1. Choose the end property and selecting the option BUILD PROPERTY. Then choose the property you wish to copy via the ADD PROPERTY dialog. Add the rule with the button ADD. 2. Choose the initial property and select the option IGNORE THIS PROPERTY, and add the rule by clicking the ADD button. Ergo the property value moved from the initial property to the end property. 70

71 Status notification contactsync can send status notification s to inform you about errors that may have occurred. Status notification is a component of each policy. If you leave this option unselected no notification will be sent. Subject: The header Send to: The SMTP-address of the person who will receive the administrative report Test: contactsync will send an to the specified address. Send only on error: contactsync will only send status notification mails if at least one error occurred during a running policy. NOTE: CONTACTSYNC DOES NOT SEND A STATUS NOTIFICATION MAIL IF A POLICY HAS NOT BEEN STARTED DUE TO AN ERROR. 71

72 Schedule Service contactsync can perform the synchronization of policies automatically. You can schedule weekly or monthly, on different days, the synchronization should be carried out. Furthermore, they can decide between what times and how many times a day the scheduler service words. Here, it is possible to synchronize the scheduler service every 15 minutes, every hour or once a day. We recommend to schedule the policies once a day. Using start time and end time option contactsync starts only in the defined period. The synchronization itself may take a longer time. 72

73 How to How to grant full access to the user mailboxes? contactsync needs a service account to import contacts into user mailboxes, which has the FULL ACCESS PERMISSION to these user mailboxes. Exchange 2010 The following article MANAGE FULL ACCESS PERMISSIONS describe for Exchange 2010, how to grant Full Access permissions to mailboxes We recommend to grant the service account for contactsync FULL ACCESS PERMISSIONS to mailboxes and disables the auto-mapping feature. This example is the command for the Exchange Management Shell to grant the contactsync service account FULL ACCESS PERMISSIONS to John Doe s mailbox: ADD-MAILBOXPERMISSION -IDENTITY 'JOHN DOE' -USER 'CONTACTSYNC' - ACCESSRIGHTS FULLACCESS -INHERITANCETYPE ALL -AUTOMAPPING $FALSE You can assign the FULL ACCESS PERMISSION for a user mailbox by using the Exchange 2010 Management Console, but you cannot bulk assign permissions for multiple mailboxes. Exchange 2013, 2016 and Exchange Online The following article MANAGE FULL ACCESS PERMISSIONS describe for Exchange 2013, 2016 and Exchange Online how to grant Full Access permissions to mailboxes We recommend to grant the service account for contactsync FULL ACCESS PERMISSIONS to mailboxes and disables the auto-mapping feature. This example is the command for the Exchange Management Shell to grant the contactsync service account FULL ACCESS PERMISSIONS to John Doe s mailbox: ADD-MAILBOXPERMISSION -IDENTITY 'JOHN DOE' -USER 'CONTACTSYNC' - ACCESSRIGHTS FULLACCESS -INHERITANCETYPE ALL -AUTOMAPPING $FALSE 73

74 Using the Exchange Admin Center (EAC) How to bulk assigns full access permissions to multiple user mailboxes You can bulk assign the FULL ACCESS PERMISSION for multiple user mailboxes with the PowerShell cmdlet at the Exchange Management Shell. You can use the parameter FILTER of Get-Mailbox to add the FULL ACCESS permissions to multiple mailboxes. This example is the command for the Exchange Management Shell to grant the contactsync service account FULL ACCESS PERMISSIONS to all user mailboxes: GET-MAILBOX -RESULTSIZE UNLIMITED -FILTER {(RECIPIENTTYPEDETAILS -EQ 'USERMAILBOX') -AND (ALIAS -NE 'CONTACTSYNC')} ADD-MAILBOXPERMISSION - USER CONTACTSYNC@CONTOSO.COM -ACCESSRIGHTS FULLACCESS -INHERITANCETYPE ALL -AUTOMAPPING $FALSE 74

75 Since Exchange 2013 you can bulk assign permissions for multiple user mailboxes by using the Exchange admin center (EAC) Click MAILBOX DELEGATION -> ADD 75

76 Troubleshooting and Support Guide Issue with Exchange Online connection The Autodiscover service returned an error Please ensure, that the server, where you run contactsync, can resolve the DNS of MICROSOFT OFFICE 365 and you can find/connect the Autodiscover to resolve the EXCHANGE WEB SERVICES URL. Please do the following steps from the contactsync server: First go to the website MICROSOFT REMOTE CONNECTIVITY ANALYZER Select the tab OFFICE 365, scroll to MICROSOFT OFFICE OUTLOOK CONNECTIVITY TESTS and choose OUTLOOK AUTODISCOVER Please run the test. Make sure that this test is successful and that contactsync can retrieve the correct URL for the EXCHANGE WEB SERVICES. 76

77 LegacyExchangeDN of the contactsync service account is in the old syntax. Please update this by r enabling the service account or create a new contactsync service account. Your current contactsync service account is migrated from an Exchange 2003 environment. The LEGACYEXCHANGEDN of the contactsync service account is in the old syntax, which was used up to Exchange 2003, however contactsync need a service account with a mailbox which has the new LEGACYEXCHANGEDN syntax which is used by Exchange 2007 and higher. Please create a new contactsync service account with a new mailbox and the same permissions like the old one. After that log on with the new contactsync service account, run the contactsync GUI with the new contactsync service account and change the contactsync service to the new contactsync service account. Use CONFIGURE SERVICE to start the wizard for changing the service account of the contactsync service. 77

78 Could not load file or assembly 'netstandard, Version= , Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51' or one of its dependencies. The system cannot find the file specified. contactsync needs the.net Framework or later, otherwise you will get errors and contactsync does not work. Error message: Could not load file or assembly 'netstandard, Version= , Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51' or one of its dependencies. The system cannot find the file specified. You can download the Microsoft.NET Framework here: 78

79 Support: What to do when I notice an error / bug? We always try to provide a very responsive, solution orientated and effective support. Should you encounter any issue, bug or inconvenience please do not hesitate to contact us. To enable us providing you the best quality support, please provide us with the following information: Environment Overview o contactsync Installations (Planned and Implemented) Domain Infrastructure (e.g.: Single Domain dom.local ) Exchange Version (e.g.: Exchange 2010 SP2) Windows Version of contactsync Machine (e.g.: Windows Server 2008 R2) contactsync Version (e.g.: 7.1.x) Does the contactsync Service Account have an Exchange Mailbox? Did you log on to the contactsync Machine using that Service Account to configure the policies? Is the contactsyncservice logging on using the Service Account? Please describe your issue/bug/inconvenience thoroughly, in detail, what you wanted to achieve and what you were doing as it occurred. A screenshot of the issue often helps us to understand We also require the configuration and the logs, preferably zipped. In menu Action -> Export Configuration you can zip the policies. In menu Action -> Export Status you can zip the log files. Do you have more questions or need further support than please do not hesitate to contact the contactsync Support Team. contactsync Support Team By phone or via support@netsec.de 79