Preparing Active Directory

With all prerequisites fulfilled we can move on and prepare the Active Directory using the respective Exchange 2007 Setup.exe switches. Exchange 2007 Setup includes several switches; we’ll go through each of those related to preparing the Active Directory in this section.

Important:
Each of the switches we go through below will be run automatically during the deployment of the first Exchange 2007 server in the Exchange legacy organization, so it’s not mandatory to run them before installing Exchange 2007, but depending on the size as well as topology of your environment, it may be wise to prepare the Active Directory first using these switches before you start the actual deployment process.

Prepare Legacy Exchange Permissions

The first thing we need to do when deploying an Exchange 2007 into a legacy Exchange organization is to run Setup.com /PrepareLegacyExchangePermissions. This is in order to grant specific Exchange permissions in the Active directory domain(s) in which one or more Exchange 2000 or 2003 Servers exist, or where Exchange 2000 or 2003 DomainPrep has been executed. The reason why we must run the Setup.com /PrepareLegacyExchangePermissions is because the Exchange 2003 or Exchange 2000 Recipient Update Service otherwise won’t function correctly after the Active Directory schema has been updated with Exchange 2007 specific attributes.

Note:
For a detailed explanation on why the Setup.com /PrepareLegacyExchangePermissions must be run in an Active Directory domain in which one or more Exchange 2000 or 2003 Servers exist, or where Exchange 2000 or 2003 DomainPrep has been executed, see this section in the Exchange 2007 Online Documentation.

In order to run Setup.com /PrepareLegacyExchangePermissions, you must open a Command Prompt window and navigate to the directory, network share or DVD media containing your Exchange 2007 Setup files, then simply type Setup.com /PrepareLegacyExchangePermissions and hit Enter as shown in Figure 1.4.

Figure 1.4: Running Setup.com with the /PrepareLegacyExchangePermissions Switch

Note:
Some of you might be in a situation where you want to prepare the Active Directory domain before you install the x64-bit version of Windows Server 2003 on a server in the Active Directory Forest, and therefore cannot run Setup.com /PrepareLegacyExchangePermissions using the 64-bit version of Exchange 2007 as you don’t have any x64-bit Windows 2003 Servers deployed yet. But fear not, as it’s fully supported to use the 32-bit version of Exchange 2007 to prepare your production Active Directory environment. As I mentioned in the introduction, the 32-bit version of Exchange 2007 is fully supported in a production environment, when speaking management tasks, and preparing the Active Directory is considered a management task.

Prepare Schema

Figure 1.5: Running Setup.com with the PrepareSchema Switch

Like was the case with the previous command, this can be done using the 32-bit version of Exchange 2007.

Prepare AD

The Setup.com /PrepareAD command is used to configure global Exchange objects in Active Directory, create the Exchange Universal Security Groups (USGs) in the root domain as well as prepare the current domain. The global objects reside under the Exchange organization container. In addition, this command creates the Exchange 2007 Administrative Group which is named Exchange Administrative Group (FYDIBOHF23SPDLT) as well as creates the Exchange 2007 Routing Group called Exchange Routing Group (DWBGZMFD01QNBJR).

As some of you may be aware, Exchange 2007 doesn’t make use of Routing Groups and Administrative Groups like Exchange 2000 or 2003 did. Administrative Groups have been dropped completely and message routing in Exchange 2007 is based on Active Directory Sites. But in order for Exchange 2007 to co-exist with Exchange 2000 or 2003, Exchange must create the mentioned Administrative Group and Routing Group, which can only be viewed via an Exchange 2000 or 2003 System Manager or by using ADSIEdit as can be seen in Figure 1.6 and 1.7 below.

Figure 1.6: Exchange 2007 Administrative and Routing Group in the Exchange 2003 System Manager

Figure 1.7: Exchange 2007 Administrative and Routing Groups in ADSIEdit

You can run the Setup.com /PrepareAD command before running /PrepareLegacyExchangePermissions and /PrepareSchema. Doing so will run the /PrepareLegacyExchangePermissions and /PrepareSchema commands automatically.

Note:
Okay with all these boring switches it’s time for a little fun! Did you know that although coding a product such as Exchange 2007 is a lot of hard work, the Exchange Product Group always has time for a little humor? To prove it let us try to take the GUID of the above Administrative Group shown in Figure 1.6 and shift each letter upwards. Do the same for the GUID of the Exchange Routing Group shown in Figure 1.7 but do it downwards. Did you manage to see what it translates to?

In order to run this command, open a Command Prompt window and type Setup.com /PrepareAD followed by Enter. Setup will now configure the organization as necessary as shown in Figure 1.8.

Figure 1.8: Running Setup.com with the PrepareAD Switch

PrepareDomain and PrepareAllDomains

It’s also possible to prepare a local domain or all domains in the Active Directory using the Setup.com /PrepareDomain and Setup.com /PrepareAllDomains respectively. These switches will set permissions on the Domain container for the Exchange Servers, Exchange Organization Administrators, Authenticated Users, and Exchange Mailbox Administrators, create the Microsoft Exchange System Objects container if it does not exist, and set permissions on this container for the Exchange Servers, Exchange Organization Administrators, and Authenticated Users and create a new domain global group in the current domain called Exchange Install Domain Servers. In addition it will add the Exchange Install Domain Servers group to the Exchange Servers USG in the root domain.

As with the commands we have already been through, these commands also need to be run from a Command Prompt window as shown in Figure 1.9.

Figure 1.9: Running Setup.com with the PrepareDomain Switch