Quest® ActiveRoles™ Exchange Resource Forest Manager
Version 1.1.1
Release Notes
January 14, 2008
Welcome to ActiveRoles Exchange Resource Forest Manager
Resolved Issues and Enhancements
Many medium- and large-size companies find themselves in an environment that requires a multi-forest Active Directory deployment for security, business policy, or legal reasons, or because of autonomous business units.
Deployment of multiple forests introduces the need for inter-forest collaboration solutions, among which the most important is the Microsoft Exchange Server based messaging system. With multiple forests, one of the options for integrating Exchange with Active Directory is the resource forest model.
The resource forest model, also referred to as dedicated Exchange forest, implies a single Exchange organization that serves multiple forests. The Exchange forest (also known as the resource forest) is dedicated to running Exchange and hosting mailboxes. User accounts are contained in one or more forests, referred to as the account forests, which are separate from the resource forest.
The ability to have user accounts and user mailboxes in separate forests requires that shadow (or proxy) versions of user accounts be created and maintained in the Exchange forest by a directory synchronization process. For example, provisioning a user account in an account forest involves creation of a shadow, mailbox-enabled user account in the Exchange forest. The account properties need to be synchronized between the account forest and the Exchange forest.
To automate the provisioning and synchronization processes involved with the resource forest model, you can use ActiveRoles Exchange Resource Forest Manager - an ActiveRoles Server-based solution that includes the following capabilities:
For more information about this solution, refer to the ActiveRoles Exchange Resource Forest Manager Administrator Guide, which is part of the ActiveRoles Server 6.0 documentation set.
As compared to version 1.0, the 1.1 release of this solution adds a new option to link existing user accounts in the resource forest to master accounts in the account forest.
By default, the AutoProvision process creates a shadow account with the same name (CN) as the name (CN) of the master account. In case of an account name conflict (a user account with the same name already exists), a shadow account is created with a different name. This behavior can now be changed by using a certain policy parameter, to have the solution link the master account with the account that already exists in the resource forest instead of creating a new account with a name that differs from the name of the master account. For details, see the description of the "Associate with existing" policy parameter in the "Parameters of the ERFM - Account AutoProvision Policy Object" section in the ActiveRoles Exchange Resource Forest Manager Administrator Guide.
This section provides a list of issues that were resolved in ActiveRoles
Exchange Resource Forest Manager version 1.1.1 (as compared to version 1.1.0).
Each item in the list includes an ID number, which identifies the item, and a
brief description of the issue.
TF00018531
Fixed: Truncated text on the Welcome page in the solution's Installation Wizard.
TF00018565
Fixed: When deprovisioning a master account, the solution may perform the
Deprovision operation two times in succession on the respective shadow account.
TF00018597
Fixed: After the "Attribute to store back link" policy parameter has been
modified, the solution may fail to perform the Deprovision operation, reporting
a policy violation error event in the EDM Server event log.
TF00018642, TF00019248
Fixed: Improper handling of non-alphanumeric characters such as # + ( ) , ; < >
\ in object names: Upon creation of a master account with a name containing
non-alphanumeric characters, the solution may fail to create the shadow account
for that master account.
TF00018662
Fixed: Uninstalling the solution does not remove the solution log file from
disk.
TF00018663
Fixed: Outdated solution abbreviation (MFSO instead of ERFM) in the name of the
default installation folder for this solution.
TF00018664
Fixed: Outdated solution abbreviation (MFSO instead of ERFM) in the names of the
solution-specific configuration objects, such as Policy Objects.
TF00018700
Fixed: Incorrect behavior in the following scenario:
- The "Associate with existing" policy parameter is set to True
- A given shadow account is linked to a certain master account
- A new master account with the same name as the shadow account is created
In this scenario, the solution links the existing shadow account to the new
master account instead of displaying an error message as expected.
TF00019170
Fixed: Deprovisioning a master account may cause a policy violation error to be
reported in the EDM Server event log.
TF00028194
Fixed: The solution may fail to delete the shadow account when the respective
master account is deprovisioned and then deleted.
TF00035128
Fixed: The "Quest ActiveRoles" prefix is missing from the solution name in the
"Add or Remove Programs" list in Control Panel.
TF00035230
Fixed: The edsaDisableInstantMessaging attribute is added by mistake to the
"Default list of substituted properties" table in the ActiveRoles Exchange
Resource Forest Manager Administrator Guide.
TF00035680
Enhancement: The default list of substituted properties has been extended to
include a number of additional Exchange-related attributes that can be retrieved
or updated by ActiveRoles Server. For the current default list, see "Substituted
Properties" in the ActiveRoles Exchange Resource Forest Manager Administrator
Guide that ships with the 1.1.1 release of this solution.
TF00038128
Fixed: Incorrect behavior in the following scenario:
- The "Associate with existing" policy parameter is set to True
- A given shadow account is linked to a certain master account
- A new master account with the same name as the shadow account is created using
the Web Interface
In this scenario, the solution creates a new shadow account instead of displaying an error message as expected.
TF00018598
If Exchange Server 2007 is deployed in the resource
forest, then Exchange Resource Forest Manager may cease
to work.
WORKAROUND
Configure the ActiveRoles Server Administration Service
to perform management tasks on Exchange Server without
using Exchange Server PowerShell
cmdlets. You can do this by
executing the following script on the computer running
the Administration Service:
option explicit
Const NewExchangeProperties ="<?xml version=""1.0""?><ExchangeProperties NeverUsePowerShellCmdlets = ""true"" UseMapiIfExchangeCmdletsNotInstalled = ""false"" />"
Dim ServiceObject
Set ServiceObject=GetObject("EDMS://CN=Server Configuration,CN=Configuration")
ServiceObject.Put "edsvaExchangeProperties", NewExchangeProperties
ServiceObject.SetInfo
Msgbox "Operation complete"
TF00018603
When searching a container in an account forest for user
accounts by using search criteria that include
Exchange-related properties, you may encounter the
following problem: The search returns no results
although the container does hold some user accounts that
meet your search criteria. This problem is due to the
fact that the search function does not take into account
the policy-based process of substituting
Exchange-related properties of the shadow accounts in
the resource forest for those properties of the master
accounts in the account forests.
When configuring Delivery Restrictions or Delivery
Options for a user account in an account forest, you may
encounter an empty list of objects in the "Select
Objects" dialog box. This problem is due to the fact
that the search function used to populate the list does
not take into account the policy-based process of
substituting Exchange-related properties of the shadow
accounts in the resource forest for those properties of
the master accounts in the account forests.
WORKAROUND
If you need to search by Exchange-related properties,
choose the scope of your search in the resource forest
rather than in account forests.
If you need to select objects when configuring Delivery
Restrictions or Delivery Options, perform configuration
on the shadow account that is associated with the master
account you want to modify.
TF00018621
With the "Synchronized Attributes List" policy parameter
modified so that the list of synchronized properties includes the "manager"
attribute, the solution fails to update the "manager" attribute in the shadow
account upon modification of that attribute in the respective master account,
reporting a policy violation error event in the EDM Server event log.
WORKAROUND
To prevent this error, avoid adding the "manager"
attribute to the list of synchronized properties. The "manager" attribute holds
the distinguished name (DN) of the manager's user account. As such, the
"manager" attribute value is forest-specific and cannot be written to a user
account in a different forest. This limitation is due to the nature of the
Active Directory directory services.
This solution runs on top of ActiveRoles Server, and requires the following to be deployed in your Active Directory environment prior to installing the solution:
Note that in addition to the main requirements for ActiveRoles Server, which can be found in the Release Notes document for ActiveRoles Server, the following requirements must be met in order for this solution to install and work:
This release is Unicode-enabled and supports any character set. In this release, all product components should be configured to use the same or compatible character encodings and should be installed to use the same locale and regional options. This release is targeted to support operations in the following regions: North America, Western Europe and Latin America, Central and Eastern Europe, Far-East Asia, Japan.
This release has the following known capabilities or limitations: Globalization status is the same as for ActiveRoles Server 6.0.0 except that the ActiveRoles Exchange Resource Forest Manager documentation is not localized.
Follow these steps to install and start working with ActiveRoles Exchange Resource Forest Manager:
You can run the Setup program from the Solutions page in the ActiveRoles Server CD Autorun window by clicking ActiveRoles Exchange Resource Forest Manager.
For information on how to deploy, configure, and use the solution, refer to the ActiveRoles Exchange Resource Forest Manager Administrator Guide, which is part of the ActiveRoles Server 6.0 documentation set.
Get the latest product information, find helpful resources, and join a
discussion with the ActiveRoles Quest team and other community members. Join the
ActiveRoles Community at
http://activeroles.inside.quest.com.
| info@quest.com | |
| Quest Software, Inc. World Headquarters 5 Polaris Way Aliso Viejo, CA 92656 USA |
|
| Web |
Refer to our Web site for regional and international office information.
Quest Support is available to customers who have a trial version of a Quest product or who have purchased a commercial version and have a valid maintenance contract.
Quest Support provides around the clock coverage with SupportLink, our web self-service. Visit SupportLink at http://support.quest.com.
From SupportLink, you can do the following:
View the Global Support Guide for a detailed explanation of support programs, online services, contact information, and policy and procedures.
The guide is available at: http://support.quest.com/pdfs/Global Support Guide.pdf.
This document contains proprietary information protected by copyright. The
software described in this guide is furnished under a software license or
nondisclosure agreement. This software may be used or copied only in accordance
with the terms of the applicable agreement. No part of this guide may be
reproduced or transmitted in any form or by any means, electronic or mechanical,
including photocopying and recording for any purpose other than the purchaser’s
personal use without the written permission of Quest Software, Inc.
© 2008 Quest Software, Inc. ALL RIGHTS RESERVED.
Quest, Quest Software, the Quest Software logo, Aelita, AppAssure, Benchmark Factory, Big Brother, DataFactory, DeployDirector, ERDisk, Fastlane, Final, Foglight, Funnel Web, I/Watch, Imceda, InLook, IntelliProfile, Internet Weather Report, InTrust, IT Dad, JClass, Jint, JProbe, Knowledge Xpert, LeccoTech, LiteSpeed, LiveReorg, Matrix Insight, Matrix.Net, MIQ, NBSpool, NetBase, Npulse, PerformaSure, PL/Vision, Quest Central, RAPS, SharePlex, Sitraka, SmartAlarm, Speed Change Manager, Speed Coefficient, Spotlight, SQL Firewall, SQL Impact, SQL LiteSpeed, SQL Navigator, SQLab, SQLGuardian, SQLProtector, SQL Watch, Stat, Stat!, StealthCollect, Tag and Follow, Toad, T.O.A.D., Vintela, Virtual DBA, Xaffire, and XRT are trademarks and registered trademarks of Quest Software, Inc in the United States of America and other countries. Other trademarks and registered trademarks used in this guide are property of their respective owners.
If you have any questions regarding your potential use of this material, contact:
|
Quest Software World Headquarters
LEGAL Dept 5 Polaris Way Aliso Viejo, CA 92656 Email: legal@quest.com |
The information in this document is provided in connection with Quest products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Quest products. EXCEPT AS SET FORTH IN QUEST'S TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and product descriptions at any time without notice. Quest does not make any commitment to update the information contained in this document.