Migrating BlackBerry-enabled mailboxes from Originally posted: August 2002 Affected software versions BlackBerry Enterprise for Exchange Summary This document provides an overview of how to migrate a BlackBerry-enabled mailbox from 5.5 to. The Active Directory Connector () supports the coexistence and integration of both versions of. This document describes the environment that is needed for the BlackBerry component and does not provide strategies for migrating from 5.5 to. Note: For more information on migration strategies, contact directly. This document assumes that the reader has a solid understanding of the installation and configuration of both 5.5 and. This document refers to a mixed-mode 5.5 and environment in which the is configured for standard operation. This document explains the impact of mailbox migration on BlackBerry-enabled components. Overview As illustrated in the following diagram (figure 1), 5.5 is installed on a Windows NT 4.0 member server in the Windows NT 4.0 domain. The assumption is that an appropriate trust relationship between the Windows NT 4.0 and the Windows native domain is already established. In addition, the Active Directory Connector () is installed and a (CA) is established to enable the Windows Active Directory (AD) and 5.5 Directory Service (DS) to communicate, replicate, and synchronize directory information. PDC 5.5 Exchange Windows Domain Figure 1: Active Directory Connector trust is installed on a member server in the Windows domain. is installed in the same 5.5 site and organization. Details on how to integrate your Exchange 5.5 and servers are available from. 2002 Research In Motion Limited www.blackberry.net Page 1 of 13
The is installed on a Windows NT 4.0 member server that is participating in the Windows NT 4.0 domain. The is configured to use a Windows NT 4.0 account and an associated 5.5 mailbox. The is also configured to service BlackBerry-enabled mailboxes on the 5.5. The following section describes different migration scenarios based on the above, assumed setup and describes any issues, problems, or contingencies of the BlackBerry-enabled components. Migration scenarios Note: You can migrate 5.5 mailboxes to in several ways. This document only refers to migration scenarios that use the Active Directory Users and Computers window and the Management console with the Active Directory Connector. For more information on installing and configuring the Active Directory Connector, refer to the web site: http://search.microsoft.com/gomsuri.asp?n=1&c=rp_results&siteid=us/itresources&target= http://www.microsoft.com/technet/prodtechnol// Exchange/deploy/confeat/exchinst.asp The Active Directory Connector replicates the directory information between the 5.5 Directory Store and the Windows domain. Therefore, the domain names (DNs) of the 5.5 mailboxes are replicated and appear under a specified organizational unit (OU) in the Active Directory Users and Computers window. As illustrated in the following figure (figure 2), user icons that appear with a white x in a red circle indicate a disabled Windows user account. Figure 2: Active Directory Users and Computers window disabled account For more information on migrating mailboxes and accounts into a Windows, environment, refer to the web site: http://www.microsoft.com/ Exchange/techinfo/deployment//default.asp. Scenario 1 This scenario explains how to migrate an existing from Windows NT 4.0 to a new Windows member server and how to migrate the mailbox to the new information store (IS). This scenario is useful for customers who want to move their current to a new hardware platform. 2002 Research In Motion Limited www.blackberry.net Page 2 of 13
Scenario 2 Migrating BlackBerry-enabled mailboxes from This scenario explains the migration process if the current is running a Windows server as a member of the existing Windows NT 4.0 domain. Scenario 3 This scenario explains how to migrate the mailbox to while the current continues to run Windows NT 4.0. This scenario does not allow the administration of the -enabled users after they are moved to. The administration process must be run from a Windows computer with the proper system requirements. This computer can be an administrator s computer if it meets the system requirements for the Management Software. Permission requirements All three migration scenarios require the same permissions in. The following steps outline the permissions that are required to enable the migrated account to access the information store, to service BlackBerry-enabled accounts. If the account was disabled before it was migrated from Exchange 5.5, you should enable it before you complete these steps. 1. Make the BlackBerry service account a member of the Local Administrators Group on the BlackBerry Enterprise (this assumes that the is not performing a domain operations role). 2. In Administrative Tools, open the Local Security Policy. 3. In the Local User Rights Assignment section, assign to the account the Log on as a service right. 4. Open the Log on as a service right. 5. Click Add and select the account to which you want to assign this permission. 6. Open System Manager for. If the Administrative Groups folder does not appear, rightclick the Organizational Level and click Properties. On the General tab, select the Show Administrative Groups and Show Routing Groups check boxes. 7. Assign the account the View Only Administrator permission. 8. Right-click the Administrative Group and select Delegate Control. The delegate control wizard appears. 2002 Research In Motion Limited www.blackberry.net Page 3 of 13
Figure 3: Exchange System Manager Administration Group menu Delegate control item Note: In the Delegate Control wizard, if the account is granted the full administration permission at the Administrative Group Level, the Send As and Receive As options are unavailable. These permissions are required for the successful operation of the server. 9. Expand the Administrative Group and the Routing Group. The server object appears. 10. Expand the server object. A list of all s in the Routing Group appears. Figure 4: System Manager server object 11. Right-click a server and click Properties. 12. Click the Security tab. The account that was added by the Delegate Control wizard appears. 13. Select this user. 2002 Research In Motion Limited www.blackberry.net Page 4 of 13
Figure 5: Properties window Security tab 14. In the Permissions section, select the following check boxes in the Allow column: Administer information store, Receive As, and Send As. This step must be repeated for each server in the site. Note: These permissions can also be assigned at the mailbox store level if there are several s. 2002 Research In Motion Limited www.blackberry.net Page 5 of 13
Scenario 1 This scenario explains how to move the BlackBerry server mailbox and how to provision a new BlackBerry server in the Windows domain. This scenario provides a seamless migration to and is most easily reversible if the permissions do not replicate properly. This process does not require users to insert their handhelds in the cradle, and the migration is not apparent to end users. In this scenario, the BlackBerry component of the migration occurs in a short period of time and the migration of the 5.5 infrastructure does not affect the. System requirements This scenario requires that the new run Windows Service Pack 2 or later. In this scenario, the new is built into the new Windows domain and the Software is installed on the new server using the existing server s information. This means that when the service starts on the new Windows server, it takes over from the previous server, and provides a seamless transition for servicing and administering the user accounts. 5.5 User User User User Exchange Windows Domain Account migration Figure 6: Existing BlackBerry deployment If you schedule your connection agreements to use the Always option, replication should occur almost immediately. You can verify this replication by inspecting the directory objects in the Active Directory Users and Computers window. Information in the 5.5 directory is uploaded to the same object in the Active Directory. You can also create a custom recipient in the 5.5 directory and make sure it replicates to the Active Directory as a contact. If objects do not appear to be replicating, right-click the connection agreement and click Replicate Now. Additionally, if you have many domain controllers in your environment, you might have to wait for some time for Active Directory replication to complete. Until replication is complete, you cannot proceed. After the Active Directory replication is confirmed, the next step is to move the mailbox from the 5.5 information store to the information store. 2002 Research In Motion Limited www.blackberry.net Page 6 of 13
Moving the mailbox To move the mailbox, complete the following steps: 1. In the Active Directory Users and Computers Management window, select the account that was migrated from the 5.5, Windows NT 4.0 environment. 2. Right-click and click Enable Account (this step is required only if you selected the option to migrate disabled accounts during the Active Directory Connector setup). 3. Stop the service on the old to allow MAPI sessions to the mailbox to close. Note: Set the service to Manual Startup to make sure that the service does not restart after the BlackBerry Enterprise is running on the new hardware. Restarting the service disables the SRP ID. 4. In the Active Directory Users and Computers Management window, select the account and select Exchange tasks. This activates the utility that moves a mailbox from the 5.5 information store to the information store. 5. Move the mailbox to a. 6. On the new, verify that the field is updated with the new server name and mailbox: on the Start menu, select Programs > > Edit BES MAPI Profile. 7. After the mailbox is moved and the MAPI profile is confirmed, restart the service on the new hardware platform. 8. Run the Handheldcleanup utility to update the mailbox with the updated mailbox information (the command is Handheldcleanup u m). The can now provide service for users on both mail systems. Service Disabled 5.5 User User User User Exchange Windows Domain Figure 7: Architecture after migration to the new system 2002 Research In Motion Limited www.blackberry.net Page 7 of 13
Scenario 2 This scenario explains how to move the mailbox to while the service remains on the same physical system. This scenario assumes that the current is running Windows Service Pack 2 or later. If this system is running Windows NT 4.0, refer to Scenario 3. Note: The permissions must still be configured in the infrastructure as detailed in the Permission requirements section of this document. 5.5 User User User User Exchange Windows Domain Figure 8: Using the existing In this scenario, the BlackBerry server is already upgraded to Windows and a 2-way trust exists between the Windows domain and the Windows NT 4.0 domain. The Active Directory is already in place and the accounts are replicated into the Active Directory. In this scenario, the mailbox must be moved to ; however, the current can remain. The can be moved into the Windows domain, but is not required. Moving the mailbox To move the mailbox, complete the following steps: 1. Stop the service to allow for MAPI sessions to the mailbox to close. 2. In the Active Directory Users and Computers Management window, select the account and click Exchange tasks. This activates the utility that moves a mailbox from the 5.5 information store to the information store. 3. Move the mailbox to a. 4. On the new, verify that the field is updated with the new server name: on the Start menu, select Programs > > Edit BES MAPI Profile. 5. After the mailbox is moved and the profile is confirmed, restart the service. 6. Run the Handheldcleanup utility to update the mailbox with the updated mailbox information (the command is Handheldcleanup u m). The can now provide service for users on both mail systems. 2002 Research In Motion Limited www.blackberry.net Page 8 of 13
5.5 User User User User Exchange Windows Domain Figure 9: mailbox migrated to the new Installing Management Note: Updates to the Management Software (MMC Snap-in) are available in service packs. Verify that you have the latest version at www.blackberry.net/support. On the, install the Management Software. One of the following database tools must be installed if you want to host the Management database on the : MSDE, SQL 7.0, or SQL. The MSDE database is included on the installation CD or in the service packs that are later than Service Pack 1. The MSDE database stores server-specific information about the that the BlackBerry Enterprise Management Software uses to manage accounts. Before it begins, the Management Software installer checks for the presence of the MSDE and prompts you to install it if it does not find the service. The Management Software is required for administering the in a native Windows, environment. If you do not have a copy of SQL 7.0 or SQL you can use the copy of MSDE on the Software CD (drive:\msde\msdex86.exe). MSDE can also be installed directly from the Office Developer CD-ROM. Note: The following procedure is necessary only if you do not have SQL 7.0 or SQL installed and you want to install MSDE. 1. Copy msdeinst.iss and msdex86.exe to C:\msdetmp. (You must create the msdetmp folder.) 2. If you want to have MSDE installed to a drive other than C:\, you must modify the MSDEInst.iss file. Open MSDEInst.iss and search for and change the following lines to the desired location: szdir=c:\mssql7 szdatadir=c:\mssql7 Warning: You cannot run the MSDE installation file from a Terminal service. 3. On the computer on which you plan to install the Management database, go to drive:\msdetmp and execute this command prompt statement from the temporary folder: start /wait msdex86.exe -s -a -f1 "drive:\msdetmp\msdeinst.iss" where drive:\msdetmp is the full path to the temporary folder. 4. Allow 5 to 10 minutes for the command to run in the background. 5. Delete the temporary folder and its contents. A new folder should be visible: drive:\mssql7 6. Further information about using and distributing MSDEx86.exe with the Visual Basic for Applications Package and Deployment wizard can be found in the document Creating and Deploying Access Solutions with the 2002 Research In Motion Limited www.blackberry.net Page 9 of 13
Data Engine (MSDEDeploy.doc), which is located in the \Wpapers folder on the Office Developer CD-ROM. 7. On the Start menu, select Programs > MSDE > Service Manager. 8. Select Start, and verify that the SQL service is running before continuing with the installation. When you install the Management Software, point the Management MAPI profile to the mailbox on the. For more information on installing the Management Software, refer to the mmc_snapin.pdf document in the Docs folder of the BlackBerry Install directory or in the extracted service pack directory. MMC Database User User 5.5 Exchange User User Windows Domain Figure 10: BlackBerry server running Windows, mailbox on 2002 Research In Motion Limited www.blackberry.net Page 10 of 13
Scenario 3 In this scenario, the current continues to run Windows NT 4.0, the mailbox is moved to, and the management is provided by a third computer. This scenario is included as an option, but is not the preferred method. This scenario consists of moving the mailbox from and then installing the Management Software on a third computer, with the MSDE database providing administration functions. 5.5 User User User User Microsof t Exchange Windows Domain Moving the mailbox Figure 11: Current Running NT 4.0 To move the mailbox, complete the following steps: 1. Stop the service to allow for MAPI sessions to the mailbox to close. 2. On one of the Windows computers, open the Active Directory Users and Computers Management window, select the account and click Exchange tasks. This activates the utility that moves a mailbox from the 5.5 information store to the information store. 3. Move the mailbox to a. 4. On the new, verify that the field is updated with the new server name: on the Start menu, select Programs > > Edit BES MAPI Profile. 5. After the mailbox is moved and the profile is confirmed, restart the service. 6. Run the Handheldcleanup utility to update the mailbox with the updated mailbox information (the command is Handheldcleanup u m). The BlackBerry can now provide service for users on both mail systems. 2002 Research In Motion Limited www.blackberry.net Page 11 of 13
Installing the Management Software on the management station If you use a third computer for administration, install the MSDE on this computer. This system does not need to be dedicated to administration, because the system load is minimal; however, the computer must meet the system requirements for the Management Software. You should perform this installation either while logged in with the account or with an account that has permissions on the information store in both systems. When the Management Software installation starts, the installer searches for an SQL service. If the service is not found, you are prompted to install SQL or MSDE. One of the following database tools must be installed if you want to host the Management database on the : MSDE, SQL 7.0, or SQL. If you do not have a copy of SQL 7.0 or SQL you can use the copy of MSDE on the Software CD (drive:\msde\msdex86.exe). MSDE can also be installed directly from the Office Developer CD-ROM. Note: The following procedure is necessary only if you do not have SQL 7.0 or SQL installed and you want to install MSDE. 1. Copy msdeinst.iss and msdex86.exe to C:\msdetmp. (You must create the msdetmp folder.) 2. If you want to have MSDE installed to a drive other than C:\, you must modify the MSDEInst.iss file. Open MSDEInst.iss and search for and change the following lines to the desired location: szdir=c:\mssql7 szdatadir=c:\mssql7 Warning: You cannot run the MSDE installation file from a Terminal service. 3. On the computer on which you plan to install the Management database, go to drive:\msdetmp and execute this command prompt statement from the temporary folder: start /wait msdex86.exe -s -a -f1 "drive:\msdetmp\msdeinst.iss" where drive:\msdetmp is the full path to the temporary folder. 4. Allow 5 to 10 minutes for the command to run in the background. 5. Delete the temporary folder and its contents. A new folder should be visible: drive:\mssql7 6. Further information about using and distributing MSDEx86.exe with the Visual Basic for Applications Package and Deployment wizard can be found in the document Creating and Deploying Access Solutions with the Data Engine (MSDEDeploy.doc), which is located in the \Wpapers folder on the Office Developer CD-ROM. 7. On the Start menu, select Programs > MSDE > Service Manager. 8. Select Start, and verify that the SQL service is running before continuing with the installation. For more information on installing the Management Software, refer to the mmc_snapin.pdf document in the Docs folder of the BlackBerry Install directory or in the extracted service pack directory. 2002 Research In Motion Limited www.blackberry.net Page 12 of 13
5.5 Windows Exchange User User User User Database Management System MMC Windows Domain Figure 12: with an administration station Conclusion As an administrator, you can migrate Blackberry-enabled mailboxes from 5.5 to Exchange without disrupting service to the end user. However, it is imperative that you carefully plan for any migration activities. As with any new service that affects change, you should thoroughly test the appropriate scenario in a controlled, lab environment before you implement it. Part number: TAE-00010-002 2002 Research In Motion Limited. All rights reserved. The BlackBerry and RIM families of related marks, images and symbols are the exclusive properties of Research In Motion Limited. RIM, Research In Motion, 'Always On, Always Connected', the envelope in motion symbol and the BlackBerry logo are registered with the U.S. Patent and Trademark Office and may be pending or registered in other countries. All other brands, product names, company names, trademarks and service marks are the properties of their respective owners. The handheld and/or associated software are protected by copyright, international treaties and various patents, including one or more of the following U.S. patents: 6,278,442; 6,271,605; 6,219,694; 6,075,470; 6,073,318; D,445,428; D,433,460; D,416,256. Other patents are registered or pending in various countries around the world. Please visit www.rim.net/patents.shtml for a current listing of applicable patents. RESEARCH IN MOTION LIMITED (RIM) ON BEHALF OF ITSELF AND ITS AFFILIATES MAKES NO REPRESENTATIONS ABOUT THE SUITABILITY OF THE INFORMATION OR GRAPHICS CONTAINED IN THIS ADVISORY FOR ANY PURPOSE. THE CONTENT CONTAINED IN THIS DOCUMENT, INCLUDING RELATED GRAPHICS, ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. RIM HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS WITH REGARD TO THIS INFORMATION, INCLUDING ALL IMPLIED WARRANTIES AND CONDITIONS OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT SHALL RIM BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF INFORMATION CONTAINED HEREIN. THIS DOCUMENT, INCLUDING ANY GRAPHICS CONTINED WITHIN THE DOCUMENT, MAY CONTAIN TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS. UPDATES ARE PERIODICALLY MADE TO THE INFORMATION HEREIN AND RIM MAY MAKE IMPROVEMENTS AND/OR CHANGES IN THE PRODUCT(S) AND/OR THE PROGRAM(S) DESCRIBED HEREIN AT ANY TIME WITHOUT NOTICE. 2002 Research In Motion Limited www.blackberry.net Page 13 of 13