Migration Approach Query

Question

Current Environment Source = Account forest with external forest trust to Target forest. No Exchange currently (was decommissioned) Target = Resource forest containing linked mailboxes (Exchange 2010) and disabled AD accounts with AEA (linked master account) set 
 
 Planned "End State" Environment Source = Domain/forest will be decommissioned Target = Previously disabled resource accounts will be enabled and used to authenticate users. Mailboxes will remain with users. Users will be provided with new machines which are members of the target domain and login with target accounts using target mailboxes. 
 
 Planned Migration Steps 
 1. Perform migration of AD group object using migration sessions and import files 2. Perform migration of AD user objects using migration sessions and import files ensuring accounts are matched to the existing target disabled accounts. Continue to leave source accounts enabled and target disabled. * At this point users are continuing to work as is without any interruption * 3. Perform AD processing of all objects leaving source account permissions in place 4. Perform Exchange processing of all mailboxes leaving source account permissions in place * Again, at this point users are continuing to work as is without any interruption * 5. Start migration of Batch 1 of the users (a) Enable batch 1 disabled accounts in target using Set-User -Identity 'mailbox name' -LinkedMasterAccount $null as per KB35991 (b) Provide batch 1 users with new machine in target domain (c) Batch 1 users login to new machine in target domain with target account, create Outlook profile etc 6. Start migration of Batch 2 and repeat previous steps 7. On completion of migration of all batches perform ADPW and EPW to remove source account and clean up 
 
 I would like to understand if my proposed timing of the ADPW and EPW processing is right and if possible is there any specific pointers around the configuration of the wizards? 
 
 Thanks Mark

Jeff Shahan · Accepted Answer

Removing all and reinstalling just the AD bits is more effort then is required. just remove the Exchange bits if they are installed. The mapping data is in the AD LDS data base and stored in the project (upped more node on the left) ADPW and EPW are part of the AD bits and license. Exchange bits are only needed if you are migrating Exchange mailboxes and PFs. 
 
 If I understand correctly we will still perform AD and EPW processing as you previously described? 
 Yes, same process as above.

Jeff Shahan · Answer

I changed the order slightly and dropped steps not directly related to Quest processed. 
 
 Perform migration of AD objects using migration sessions and import files ensuring accounts are matched to the existing target disabled accounts. 
 Perform migration of AD group object using migration sessions and import files 
 Enabled Directory Sync with all inscope objects (matched from step 1/2) to maintain target objects and group membership changes during phased migration 
 Perform AD processing of all objects appending permissions in scope objects. 
 Perform Exchange processing of all mailboxes appending permissions across all mailboxes and public folders (if they exist) 
 Start migration of Batch 1 of the users
 
 Execute a Migration Session, enable target users. This will unlink the linked mailbox object, and set it to user mailbox. Note: sidhistory should be applied during this Migration session. It is not supported by Exchange for sidhistory to be present while the mailbox is linked.

Start migration of Batch 2 
 On completion of all migration batches, perform ADPW and EPW to replace all permissions across all in-scope objects, mailboxes and public folders (if they exist) 
 
 Because you are using a phased migration approach, permissions in AD and EX change be changed post step 3/4 and prior to step 7. The "Replace" mode of step 7 combined with sid history address this gap.