EV cross domain Exchange upgrade and migration

[giuliod]

Hello All,

We are currently running Symantec Enterprise Vault version 9.0 SP1 archiving from Exchange 2007 on a domain let's say abc.com.

There is a requirement to move EV to a new domain xyz.com and also upgrade Exchange to 2010 on the xyz.com domain. Notice each domain has its DC and there is a two-way trust relationship between them.

Our plan was/is to;

1. Create new VSA on new domain and assign permissions on Exchange, SQL and EV
2. De-promote from old domain and join EV to new domain
3. Configure and add new Exchange 2010 within EV
4. Then start migration of mailboxes from Exchange 2007 to 2010

Currently we have joined the new domain but are facing some issues where the new VSA (create on xyz.comdomain) doesn’t seem to inherit the permissions on the old (abc.com) Exchange 2007 server or the permissions are not replicating for some reasons. Therefore the archiving on the old Exchange doesn’t work (the archiving tasks fail to start).

Have you ever come across with a similar scenario? Any clues or different/better aproaches?

Thanks a lot in advance.

[ZeRoC00L]

Did your (re)run the command SetEVExchangePermissions for the new VSA ?

[giuliod]

Yes, both SetEVExchangePermissions script and also double-checked using adsiedit.

[ZeRoC00L]

You say that the archiving tasks fail to start, can you post error logs and/or a dtrace ?

[giuliod]

Thanks for your reply. Acutally we are getting below error on DS:

The user xyz\VSA does not have the required Exchange Administrator permissions (including 'send as' and 'receive as' permissions) on server exch.abc.com or the Active Directory Permissions could not be read for that server.

When starting the Archiving tasks we're getting: 3305, 2256 event id's in event viewer. I've gone through this article http://www.symantec.com/business/support/index?page=content&id=TECH48936 but the problem persists. 

[ZeRoC00L]

Did your re-run SetEVExchangePermissions on the exchange server exch.abc.com and specifiy the account xyz\VSA ?

Also make sure account xyz\VSA is NO domain admin in domain ABC.

[giuliod]

Hi - Yes, I've run the script using xyz\VSA and also comfirmed it is not a domain admin on any of the domains. 

[ZeRoC00L]

Run the deployment scanner and make sure that it passes all Exchange tests.

Make sure the system mailbox is not hidden.

Can the Vault Service account open the sys mailbox without credential prompts?

[giuliod]

We have checked the permissions again but the DS is giving the same error regarding the Exchange server. Notice the system mailbox is not hidden.

What do you mean by "can the Vault Service account open the sys mailbox without credential prompts?" How can I confirm that? Thanks :)

[ZeRoC00L]

Logon to the EV server with the EV service account.

Then open the Exchange EV system mailbox for the failing Exchange server. Normally the EV service account should have access to it without asking for credentials.