Install Exchange 2003 on Additional Servers

Exchange Server Deployment Tools

Exchange Server Deployment Tools

You have found the Help file for the Exchange Server Deployment Tools.

You can start the Exchange Server Deployment Tools now by performing any of the following steps:

  • Open the Setup.exe file on the Exchange compact disc (located in the root folder) and click the Exchange Deployment Tools link.
  • Open the exdeploy.hta file on the Exchange compact disc (located in the support\ExDeploy folder).
  • Go to the Exchange Tools Web site to download the most recent version of the Exchange Server Deployment Tools.


ADCCheck Tool Group

ADCheck is a group of tools you can run after you install Active Directory Connector to ensure that user and non-user objects were replicated properly to Active Directory and vice versa. ADCCheck runs the following tools:

  • ADCUserCheck
  • ADCObjectCheck
  • ADUserScan

To run ADCCheck, your account must have Domain Administrator permissions (with rights to write to Active Directory) and Exchange 5.5 administrator permissions (with rights to view objects in the Exchange directory).


ADCConfigCheck Tool

ADCConfigCheck (Check Exchange 5.5 Directory Configuration) ensures that Exchange 5.5 directory configuration objects were properly replicated from the Exchange 5.5 directory to Active Directory by searching Active Directory using the Exchange 5.5 object’s ADCglobalNames attribute. ADCConfigCheck lists any Exchange 5.5 configuration objects that are missing from Active Directory. It is highly recommended that you run this tool after Exchange Server 2003 Setup.

After setting up Active Directory Connector, you should allow enough time for objects to replicate before running ADCConfigCheck. Otherwise, the log file will contain several errors stating that objects were not properly replicated. The log file will contain these same errors if you run ADCConfigCheck before setting up Active Directory Connector.

ADCConfigCheck is a stand-alone tool and is not contained in any of the tool groups. To run ADCConfigCheck, your account must have Domain Administrator permissions (with rights to write to Active Directory) and Exchange 5.5 Administrator permissions (with rights to view objects in the Exchange directory).

Output

ADCConfigCheck sends output to the ExDeploy.log file and the adcconfigcheck.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). ADCConfigCheck does not run automatically during Exchange Server 2003 Setup.

adcconfigcheck.log

adcconfigcheck.log lists the following errors or warnings if they occur.
Error or Warning Message | Corrective Action
Warning: Your Exchange 5.5 directory and Active Directory are not synchronized. (Mailbox: '%1'). | The Exchange 5.5 directory and Active Directory are not synchronized, which means that either Active Directory Connector is not installed or data has not yet fully replicated between the directories. Follow the deployment steps to install Active Directory connector and wait for data to fully replicate before you continue. For additional troubleshooting steps, see Microsoft Knowledge Base article 253841.
Error: Multiple Active Directory objects found for '%1'. Distinguished Name (DN) of the Active Directory object: '%2'. | Active Directory contains multiple objects that match an Exchange 5.5 object.
Error: Configuration object '%1' has not replicated to the Active Directory. | Either Active Directory Connector is not set up, or replication has not yet completed. Before you run ADCConfigCheck, set up Active Directory Connector and allow enough time for all objects to be replicated. Then run ADCConfigCheck again.
Warning: Either you do not have permission to view hidden objects in the Exchange 5.5 directory, or the directory is not Exchange 5.5 SP1 or later. Returned information may be inaccurate. | Ensure that your account has the View Only Admin role (at a minimum) in the Exchange 5.5 directory under the organization, site, and configuration nodes. Ensure that the specified Exchange server is running Exchange 5.5 SP3 or a later version. If access is still denied, add the current Active Directory account to the Exchange 5.5 server's Local Administrators group.
There is no Microsoft Exchange organization object in the Active Directory. No Exchange 5.5 configuration objects could have been replicated to the Active Directory. The ADCConfigCheck will be skipped. | Ensure that the Active Directory forest contains a server running Exchange 5.5 SP3 or later.

ExDeploy.log

ExDeploy.log indicates whether ADCConfigCheck ran successfully and includes any errors or warnings that appear in adcconfigcheck.log. (For more information, see ExDeploy Log File.)


ADCObjectCheck Tool

ADCObjectCheck is one of the tools that runs when you use ADC Tools in Active Directory Connector. ADCObjectCheck ensures that non-user, non-configuration objects in the Exchange 5.5 directory properly replicated to Active Directory. It confirms consistency of public folders, distribution lists, and contact objects between the Exchange 5.5 directory and Active Directory. If a public folder is not replicated to Active Directory, it recommends a public folder connection agreement. ADCObjectCheck also recommends custom recipient connection agreements and distribution list connection agreements.

Output

When run from ADC Tools, ADCObjectCheck sends output to the ADCTools log file in the directory you specify. When run from the command prompt, ADCObjectCheck sends output to the ExDeploy.log file and the adcobjectcheck.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). ADCObjectCheck also runs automatically during Exchange Server 2003 Setup and sends output to the Exchange Server Setup Progress log on drive C. The log indicates whether ADCObjectCheck ran successfully and lists any objects that are missing from Active Directory. The log also indicates if Setup was attempted without having previously run ADCObjectCheck.

Adcobjectcheck.log

The adcobjectcheck.log file lists the following information:

  • Display names and Exchange 5.5 distinguished names of objects that are missing from Active Directory.
  • Recommended custom recipient connection agreements.
  • Recommended distribution list connection agreements.
  • Recommended public folder connection agreements.

The adcobjectcheck.log file lists the following errors or warnings if they occur.

Error or Warning Message | Corrective Action
Warning: Your Exchange 5.5 directory and Active Directory are not synchronized. (Mailbox: '%1'). | The Exchange 5.5 directory and Active Directory are not synchronized, which means that either Active Directory Connector is not installed or data has not yet fully replicated between the directories. Follow the deployment steps to install Active Directory connector and wait for data to fully replicate before you continue. For additional troubleshooting steps, see Microsoft Knowledge Base article 253841.
Error: Multiple Active Directory objects found for '%1'. Distinguished Name (DN) of the Active Directory object: '%2'. | Active Directory contains multiple objects that match an Exchange 5.5 object.
Warning: Either you do not have permission to view hidden objects in the Exchange 5.5 directory, or the directory is not Exchange 5.5 SP1 or later. Returned information may be inaccurate. | Ensure your account has the View Only Admin role (at a minimum) in the Exchange 5.5 directory under the organization, site, and configuration nodes. Ensure that the specified Exchange server is running Exchange 5.5 SP3 or a later version. If access is still denied, add the current Active Directory account to the Exchange 5.5 server's Local Administrators group.
ADODB returned error %1 when issuing query '%2'. |
Recommending Primary Connection Agreement from Exchange 5.5 site '%1'. (Distinguished Name: '%2'). | The object does not exist in Active Directory. If you want to replicate this object to Active Directory, create a primary connection agreement from the specified Exchange 5.5 site to the Active Directory domain to create the object and replicate data.

ExDeploy.log

ExDeploy.log indicates whether ADCObjectCheck ran successfully and includes the list of recommended connection agreements. ExDeploy.log also lists any errors or warnings that appear in adcobjectcheck.log. (For more information, see ExDeploy Log File.)


ADCUserCheck Tool

ADCUserCheck (Active Directory Connector User Check) identifies the locations of user accounts and mailboxes and uses this information to recommend the connection agreements that you should set up. ADCUserCheck also uses the search process in Active Directory Connector to compare user objects in the Exchange 5.5 directory to objects in the Active Directory global catalog and reports any users in the Exchange 5.5 directory who are missing from Active Directory.

How ADCUserCheck Determines Connection Agreements

ADCUserCheck compares user accounts and mailboxes in Exchange 5.5 to objects in the Active Directory global catalog. The objects match when the assoc-nt-account attribute in Exchange 5.5 matches the ObjectSid attribute or the SidHistory attribute in Active Directory, except when:

  • The Exchange 5.5 object matches an Active Directory user object but the Exchange 5.5 object's extension-attribute-10 attribute is NTDS Contact
    • .
  • The Exchange 5.5 object matches an Active Directory user object but the Exchange 5.5 object's extension-attribute-10 attribute is NTDSNoMatch
    • .
  • The matching Active Directory object's LegacyExchangeDN attribute is not null.

ADCUserCheck uses the results to compile a recommended list of connection agreements based on the criteria in the following table.

Connection Agreement Criteria

Exchange 5.5 Object Found | Active Directory Object Found | Recommended Connection Agreement
Jeff Smith's mailbox with an associated Windows NT account | Jeff Smith user object with a mailbox attribute | None
Jeff Smith's mailbox with an associated Windows NT account | Jeff Smith user object (no mailbox attribute) | Create a connection agreement from the site of Jeff Smith's mailbox to the Active Directory domain where Jeff Smith's user object is located
Jeff Smith's mailbox with an associated Windows NT account | (no user) | Create a primary connection agreement (to create new objects in Active Directory) from the site of Jeff Smith's mailbox to Active Directory
Jeff Smith's mailbox without an associated Windows NT account | (no user) | Create a primary connection agreement (to create new objects in Active Directory) from the site of Jeff Smith's mailbox to Active Directory

Output

ADCUserCheck sends output to the ExDeploy.log file and the adcusercheck.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). ADCUserCheck also runs automatically during Exchange Server 2003 Setup and sends output to the Exchange Server Setup Progress log at the root of the drive where you installed Exchange. The log indicates whether ADCUserCheck ran successfully and includes any errors or warnings.

Adcusercheck.log

For each user in the organization, adcusercheck.log lists the location of the Exchange 5.5 mailbox and the location of the Active Directory user object. Adcusercheck.log also lists the recommended connection agreements.

Adcusercheck.log lists the following errors or warnings if they occur.

Error or Warning Message | Corrective Action
There is no associated Windows NT account (Assoc-NT-Account) for the mailbox: '%1'. | The Exchange 5.5 mailbox does not have a corresponding Windows NT account. If the NTDSNOMATCH attribute has been assigned to the mailbox, after the mailbox is replicated to Active Directory, it will be assigned the role of Self. If a user requires access to this mailbox, you must set up access rights manually.
Error: Security identifier (SID) for the associated Windows NT account (Assoc-NT-Account) for the mailbox '%1' could not be found. The security identifier (SID) for a user object in Active Directory does not correspond to an Exchange 5.5 mailbox. This error can occur if the Exchange 5.5 object's primary Windows NT account was deleted from the domain and now shows "\Unknown Account" in the Exchange 5.5 administrator program. You can correct this problem by doing one of the following:
  • Use custom attribute 10 to designate the object as either a resource mailbox (by entering NTDSNoMatch) or a contact (by entering NTDSContact).
  • Import the <sitename>.csv file that was generated by NTDSNoMatch.
  • Use "raw mode" to clear the SID from the primary Windows NT account (see Microsoft Knowledge Base article 237472.)
Warning: Your Exchange 5.5 directory and Active Directory are not synchronized. (Mailbox: '%1'). | The Exchange 5.5 directory and Active Directory are not synchronized, which means that either Active Directory Connector is not installed or data has not yet fully replicated between the directories. Follow the deployment steps to install Active Directory connector and wait for data to fully replicate before you continue. For additional troubleshooting steps, see Microsoft Knowledge Base article 253841.
Error: Multiple Active Directory objects found for '%1'. Distinguished Name (DN) of the Active Directory object: '%2'. | Active Directory contains multiple objects that match an Exchange 5.5 object.
Warning: Either you do not have permission to view hidden objects in the Exchange 5.5 directory, or the directory is not Exchange 5.5 SP1 or later. Returned information may be inaccurate. | Ensure your account has the View Only Admin role (at a minimum) in the Exchange 5.5 directory under the organization, site, and configuration nodes. Ensure that the specified Exchange server is running Exchange 5.5 SP3 or a later version. If access is still denied, add the current Active Directory account to the Exchange 5.5 server's Local Administrators group.
ADODB returned error %1 when issuing query '%2'.
Recommending Primary Connection Agreement from Exchange 5.5 site '%1'. (Distinguished Name: '%2'). | The object does not exist in Active Directory. If you want to replicate this object to Active Directory, create a primary connection agreement from the specified Exchange 5.5 site to the Active Directory domain to create the object and replicate data.
Recommending Primary Connection Agreement from Exchange 5.5 site '%1'. (Distinguished Name: '%2', ExtensionAttribute10: '%3'). | The object does not exist in Active Directory. If you want to replicate the object to Active Directory, create a primary connection agreement from the specified Exchange 5.5 site to the Active Directory domain to create the object and replicate data.
Recommending Connection Agreement between Exchange 5.5 site '%1' and domain '%2'. (Distinguished Name: '%3') | The data for this user object is not replicated in Active Directory. If you want to synchronize the user object data in Active Directory and the Exchange 5.5 directory, create a connection agreement from the specified Exchange 5.5 site to the specified Active Directory domain.

ExDeploy.log

ExDeploy.log indicates whether ADCUserCheck ran successfully and includes the list of recommended connection agreements. ExDeploy.log also lists any errors or warnings that appear in adcusercheck.log. (For more information, see ExDeploy Log File.)


ADUserScan Tool

ADUserScan verifies that mail-enabled users in Active Directory are replicated to the Exchange 5.5 directory. ADUserScan searches objects in Active Directory by targetaddress, emailaddress, proxyaddress, msExchHomeServerName, and legacyExchageDN. Then it searches the Exchange 5.5 directory for each object’s counterpart using the legacy DN. If objects have not replicated from Active Directory to the Exchange 5.5 directory, ADUserScan recommends connection agreements. It is highly recommended that you run ADUserScan after you install Active Directory Connector. Run ADUserScan alone or as part of the ADCCheck tool group.

To run ADUserScan, your account must have Domain Administrator permissions (with rights to view objects in Active Directory) and Exchange 5.5 administrator permissions (with rights to view objects in the Exchange directory).

Output

ADUserScan sends output to the ExDeploy.log file and the aduserscan.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). ADUserScan does not run automatically during Exchange Server 2003 Setup.

aduserscan.log

For each user in the organization, aduserscan.log lists following information for user objects that are missing from the Exchange 5.5 directory:

  • Display name
  • Active Directory distinguished name
  • Exchange 5.5 distinguished name
  • object globally unique identifier (GUID)
  • Recommended connection agreements.

aduserscan.log also lists the following errors or warnings if they occur.

Error or Warning Message | Corrective Action
Warning: Your Exchange 5.5 directory and Active Directory are not synchronized. (Mailbox: '%1'). | The Exchange 5.5 directory and Active Directory are not synchronized, which means that either Active Directory Connector is not set up or data has not yet fully replicated between the directories. Follow the deployment steps to install Active Directory connector and wait for data to fully replicate before you continue. For additional troubleshooting steps, see Microsoft Knowledge Base article 253841.
Error: Multiple Active Directory objects found for '%1'. Distinguished Name (DN) of the Active Directory object: '%2'. | Active Directory contains multiple objects that match an Exchange 5.5 object.
Error: An error occurred while searching for Active Directory objects with msexchADCGlobalNames = Ex5:<'%1'>. | ADCUserScan was unable to find Active Directory objects. There may be a problem with network or LDAP connectivity; check network connections and run ADCUserScan again. Or, you may not have sufficient permissions to access Active Directory; your account must have "read" permissions or higher.
Warning: Either you do not have permission to view hidden objects in the Exchange 5.5 directory, or the directory is not Exchange 5.5 SP1 or later. Returned information may be inaccurate. | Ensure your account has the View Only Admin role (at a minimum) in the Exchange 5.5 directory under the organization, site, and configuration nodes. Ensure that the specified Exchange server is running Exchange 5.5 SP3 or a later version. If access is still denied, add the current Active Directory account to the Exchange 5.5 server's Local Administrators group.
ADODB returned error %1 when issuing query '%2'. |
Recommending Connection Agreement between Exchange 5.5 site '%1' and domain '%2'. (Distinguished Name: '%3') | The data for this user object is not replicated in the Exchange 5.5 directory. If you want to synchronize the user object data in the Exchange 5.5 directory and Active Directory, create a connection agreement from the specified Exchange 5.5 site to the specified Active Directory domain.
Recommending Primary Connection Agreement from domain '%1'. (Distinguished Name: '%2'). | The object does not exist in the Exchange 5.5 directory. If you want to replicate the object to the Exchange 5.5 directory, create a primary connection agreement from the specified Active Directory domain to the Exchange 5.5 site to create the object and replicate data.

ExDeploy.log

ExDeploy.log indicates whether ADUserScan ran successfully and includes the list of recommended connection agreements. ExDeploy.log also lists any errors or warnings that appear in aduserscan.log. (For more information, see ExDeploy Log File.)


DomainPrep

The /DomainPrep option in Exchange Setup creates the groups and permissions necessary for Exchange servers to read and modify user attributes. DomainPrep creates two new domain groups: Exchange Domain Servers (a Windows global security group) and Exchange Enterprise Servers (a Windows domain local security group).

DomainPrep also creates the Public Folder proxy container in Active Directory. The Public Folder object (Microsoft Exchange System Objects) exists outside the forest-wide configuration container. In contrast with ForestPrep, which extends the schema in the forest-wide configuration container, DomainPrep creates the public folder proxy container on a per-domain basis.

DomainPrep performs the Exchange setup tasks that require Domain Administrator permissions. DomainPrep should be run by a member of the Domain Admins group. You must run DomainPrep once in each domain that contains an Exchange 2003 server and in any domain that hosts Exchange users. (An Exchange domain that contains mail-enabled users, but no Exchange servers, is a user domain.) Exchange requires contact with at least one global catalog server that is located in a domain where DomainPrep has been run.


ForestPrep

The /ForestPrep option in Exchange Setup extends the Active Directory schema to include Exchange-specific classes and attributes. ForestPrep also creates the container object for the Exchange 2003 organization in Active Directory. You must run ForestPrep once in the Active Directory forest in the domain where the schema master resides. (By default, the schema master runs on the first Windows domain controller installed in a forest). Setup checks whether you are running ForestPrep in the correct domain; if not, Setup tells you which domain contains the schema master.

The account you use to run ForestPrep must be a member of the Enterprise Admins group and the Schema Admins group. During ForestPrep, you will designate an account that will have Exchange Full Administrator permissions to the organization object. This account will have the authority to install and manage Exchange 2003 throughout the forest and assign further administrators Exchange Full Administrator permissions after the first server is installed.


The Importance of a Windows Native Mode Domain

A Windows 2000 or Windows Server 2003 native mode domain allows you to use universal groups for distribution and security. Universal groups can contain members from any domain, and you can use them in any domain. Universal groups offer the following benefits:

  • Outlook users can view the membership of a universal distribution group even if the group is stored in a different domain. In contrast, Outlook users can see the membership of global groups and local groups only if they are contained within the user's domain.
  • Access control lists (ACLs) for public folders in Exchange Server 2003 can contain universal groups, just as ACLs for public folders in Exchange 5.5 can contain distribution lists. The Windows domain must be in native mode so that distribution lists in Exchange 5.5 public folder ACLs convert properly to universal groups.
  • You can mail-enable a universal group, which can be either a security group or a distribution group. By creating a mail-enabled universal security group, you can assign access permissions to the group and send messages to the group’s alias. By creating a universal distribution group, you can cross security boundaries and more accurately reflect the flow of messages within your organization.

A Windows 2000 or Windows Server 2003 domain is initially in mixed mode until you change the domain to native mode. If a domain does not contain any Windows NT 4.0 backup domain controllers, you can change the domain to native mode. Changing the Windows domain to native mode is irreversible; Windows does not allow you to change back to mixed mode.

Important It is recommended that you install the initial Exchange 2003 server in a Windows native mode domain and store all universal groups in this domain. To preserve distribution list functionality and to ensure that public folder permissions convert properly, use this domain as your group management domain. A group management domain is a Windows domain that has been switched to native mode and is the target of an Active Directory Connector connection agreement that is extracting distribution list data from an Exchange 5.5 site. (For more information, see Universal Groups and Public Folder Permissions below.)

Note Not all domains in the forest must be in native mode to use universal groups. You can add a single native mode domain in which you can store universal security groups.

Universal Groups and Public Folder Permissions

In Exchange 5.5 and earlier versions, you can use distribution lists to assign permissions to public folders. In Exchange Server 2003, you can use Windows 2000 or Windows Server 2003 universal security groups for the same purpose by including universal security groups in a public folder’s Access Control List (ACL).

If any public folder ACLs in your existing Exchange 5.5 organization contain distribution lists, you should populate a Windows native mode domain with all of your Exchange 5.5 distribution lists. Initially, Active Directory stores the distribution lists as universal distribution groups. When you install Exchange Server 2003, as long as the universal distribution groups were created in a native mode domain, the Microsoft Exchange Information Store service converts the universal distribution groups to universal security groups. Then, when you move public folders to Exchange Server 2003, the distribution groups listed in ACLs will convert to the corresponding universal security groups.

If the universal distribution groups were created in a mixed mode domain, however, the Information Store service cannot convert them to universal security groups, and members of the group will not have access to the public folder on the Exchange 2003 server until their group is upgraded.


ConfigDSInteg Tool

ConfigDSInteg (Check Exchange Server 2003 Configuration) runs configuration object checks that are designed to detect problems in Active Directory after Active Directory Connector has been running. It is highly recommended that you run this tool after Exchange Server 2003 Setup.

To run ConfigDSInteg, your account must have Domain Administrator permissions (with rights to view objects in Active Directory).

Output

ConfigDSInteg sends output to the ExDeploy.log file and the e2kdsinteg.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). The ExDeploy.log file indicates whether ConfigDSInteg ran successfully. The e2kdsinteg.log file lists any warnings that result from the configuration object checks. These warnings are listed below. ConfigDSInteg does not run automatically during Exchange Server 2003 Setup.

Important If the log file contains a large number of errors or warnings, ensure that the server you specified in Global Catalog server is a global catalog server and not a domain controller.

ConfigDSInteg Warnings

The following warnings may appear in the e2kdsinteg.log file.

  • Public mailbox database contains no home MTA
  • Public mailbox database contains no Exchange 5.5 distinguished name
  • Public mailbox database does not belong to an existing top-level hierarchy
  • Public mailbox database does not contain an owning server
  • Public mailbox database contains no proxy addresses
  • Public mailbox database contains no primary SMTP address
  • Public mailbox database contains no primary X.400 address
  • Public mailbox database contains an ambiguous Exchange 5.5 distinguished name
  • Private mailbox database contains no Exchange 5.5 distinguished name
  • Private mailbox database is not linked to a corresponding public mailbox database
  • Private mailbox database does not have a corresponding gateway object in Active Directory
  • Private mailbox database contains an ambiguous Exchange 5.5 distinguished name
  • MTA contains duplicate Exchange 5.5 distinguished name
  • MTA contains an ambiguous Exchange 5.5 distinguished name
  • Site Replication Service (SRS) contains no proxy addresses
  • SRS contains no primary SMTP address
  • SRS contains no primary X.400 address
  • SRS contains no home mailbox database
  • SRS contains no home MTA
  • SRS contains no Exchange 5.5 distinguished name
  • SRS has duplicate Exchange 5.5 distinguished name
  • System attendant contains no proxy addresses
  • System attendant contains no primary SMTP address
  • System attendant contains no primary X.400 address
  • System attendant contains no home mailbox database
  • System attendant contains no home MTA
  • System attendant contains no Exchange 5.5 distinguished name
  • System attendant contains an ambiguous Exchange 5.5 distinguished name
  • Exchange server does not belong to a routing group
  • Exchange server does not have a responsible MTA server
  • Exchange server contains no Exchange 5.5 distinguished name
  • Exchange server contains an ambiguous Exchange 5.5 distinguished name
  • Recipient policy does not contain an associated administrative group
  • Recipient Update Service contains no GUID to the Exchange Enterprise Servers group
  • Recipient Update Service contains no SID to the Exchange Enterprise Servers group
  • Recipient Update Service contains no GUID to the Exchange Domain Servers group
  • Recipient Update Service contains no SID to the Exchange Domain Servers group
  • GWART contains no RID server
  • Connector contains no home mailbox database
  • The GUID in the name of this object does not reference a valid mailbox database
  • MAIL_GATEWAY Object is mailbox enabled and contains no home MTA
  • Connector contains no Exchange 5.5 distinguished name
  • Connector contains an ambiguous Exchange 5.5 distinguished name
  • Object is of unknown type


DCDiag Tool

DCDiag (Domain Controller Diagnostics) is a Windows support tool that tests network connectivity and DNS resolution for domain controllers. (By contrast, NetDiag tests network connectivity and DNS resolution for workstations and servers.)

Run DCDiag during the planning phase. DCDiag is a stand-alone tool and is not contained in any of the tool groups.

DCDiag Syntax

Run DCDiag at the command prompt by using the following syntax:

dcdiag /f:<log file name>

If you are running DCDiag from a member server, add the option /s:<domain controller> to specify a domain controller.

Output

DCDiag sends output to the log file you specify when you run the tool. If you do not have Enterprise Administrator permissions, several tests under the Doing primary tests heading may not pass. You can ignore these tests if the connectivity tests pass. In addition, the log file may report that some of the service validation tests did not pass. You can ignore these messages if the services do not exist on the domain controller.


Welcome to the Microsoft Exchange Server Deployment Tools

Exchange Server Deployment Tools
Welcome to the Exchange Server Deployment Tools

Version: June 2003

This guide provides the recommended steps and tools to help you successfully install Microsoft Exchange Server 2003.

Important Before you begin, go to the Exchange Tools Web site and check for a more recent version of the Exchange Server Deployment Tools.

To continue, select one of the following processes:

  • Deploy the first Exchange 2003 server
  • Install Exchange 2003 on additional servers
  • Perform post-installation steps
  • Install Exchange System Management Tools Only

Note To browse all of the supporting documents referenced in this guide, see Reference Documentation.


DSConfigSum Tool

DSConfigSum (Exchange 5.5 Directory Configuration Summary) is an optional tool run during the planning stage to scope the deployment. DSConfigSum reports the total number of Exchange 5.5 sites and the total number of servers in each site. Run this tool alone or as part of the DSScopeScan tool group.

To run DSConfigSum, your account must have Exchange 5.5 Administrator permissions (with rights to view objects in the Exchange directory).

Output

DSConfigSum sends output to the ExDeploy.log file and the dsconfigsum.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). DSConfigSum does not run automatically during Exchange Server 2003 Setup.

Dsconfigsum.log

The dsconfigsum.log file lists the total number of Exchange 5.5 sites and the number of servers in each site. The log lists the following information for each server in the organization:

  • Server name and Exchange version
  • Whether the server contains a public folder store
  • Whether Key Management Service is installed
  • Whether Internet Mail Service is installed
  • Whether the server is a directory bridgehead server
  • Total number of inbound connectors
  • Total number of outbound connectors
  • Total number of two-way connectors
The dsconfigsum.log file also lists the following errors or warnings if they occur.

Error or Warning Message | Corrective Action
Error: Server '%1' has no associated public folder store. | On the server indicated, associate a public folder store with each mailbox store. To do this, on the mailbox store's Properties, on the General tab, specify a public folder store under Default public store. If you are using a separate server as the dedicated public folder server, specify the dedicated server's public folder store. Otherwise, create a new public folder store within the storage group, and specify this new public folder store.
Warning: Either you do not have permission to view hidden objects in the Exchange 5.5 directory, or the directory is not Exchange 5.5 SP1 or later. Returned information may be inaccurate. | Ensure that your account has the View Only Admin role (at a minimum) in the Exchange 5.5 directory under the organization, site, and configuration nodes. Ensure that the specified Exchange server is running Exchange 5.5 SP3 or a later version. If access is still denied, add the current Active Directory account to the Exchange 5.5 server's Local Administrators group.

ExDeploy.log

ExDeploy.log lists the total number of Exchange 5.5 sites and the number of servers in each site. ExDeploy.log also indicates whether DSConfigSum ran successfully and includes any errors or warnings that appear in dsconfigsum.log. (For more information, see ExDeploy Log File.)


DSObjectSum Tool

DSObjectSum (Exchange 5.5 Directory Object Summary) is an optional tool run during the planning stage to scope the deployment. It reports the total number of public folders, distribution lists, distribution lists with hidden membership, and contact objects. Run this tool alone or as part of the DSScopeScan tool group.

To run DSObjectSum, your account must have Exchange 5.5 Administrator permissions (with rights to view objects in the Exchange directory).

Output

DSObjectSum sends output to the ExDeploy.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). DSObjectSum does not run automatically during Exchange Server 2003 Setup.

ExDeploy.log

ExDeploy.log lists the following DSObjectSum information:

  • Number of public folder objects in the directory, including system folders that are used for configuration and replication
  • Number of distribution lists
  • Number of distribution lists with hidden membership
  • Number of contact objects

ExDeploy.log also indicates whether DSObjectSum ran successfully and includes any errors or warnings. (For more information, see ExDeploy Log File.)


DSScopeScan Tool Group

To help gauge the scope of your deployment, you can use the DSScopeScan tool group during planning and before you install Active Directory Connector. DSScopeScan runs the following tools:

  • DSConfigSum
  • DSObjectSum
  • UserCount
  • VerCheck

The minimum amount of permissions required to successfully run these tools are View Only Admin permissions in the Exchange 5.5 site and configuration containers.


Coexistence with Exchange 5.5 - Phase 1

Exchange Server Deployment Tools

Coexistence with Exchange 5.5

Phase 1 - Phase 2 - Phase 3

For a list of prerequisites, see Exchange 5.5 Coexistence Prerequisites.

Phase 1: Planning

Steps | Reference
1. On the server, install Windows 2000 Server SP3 or later, Windows 2000 Advanced Server SP3 or later, or Windows Server 2003. Operating System and Active Directory Requirements
Where to Install New Server Hardware
2. Verify that the NNTP, SMTP, and World Wide Web services are installed and enabled on the server. If you are running Windows Server 2003, verify that ASP.NET is installed. | Enabling Windows Services
3. Specify the Exchange 5.5 server that hosts mailboxes, the Windows global catalog server, and a log file location. Then run DSScopeScan. To run DSScopeScan, your account must have Exchange 5.5 administrator permissions (with rights to view objects in the Exchange directory). If the Exchange 5.5 server is using an LDAP port other than the default of 389, enter the Exchange 5.5 server in the format <5.5 server>:<port number>.

    Exchange 5.5 server (required)
    Global catalog server
    Log file path
    Run DSScopeScan now

DSScopeScan

4. Install the Windows 2000 SP3 or Windows 2003 version of the Windows Support Tools from the Support folder on the Windows compact disc. Be sure to install the version that matches the operating system of the server. DCDiag (Domain Controller Diagnostics) and NetDiag (Network Connectivity Tester) are included in the Windows Support Tools.

5. Run DCDiag to test network connectivity and DNS resolution. (Your account must have Domain Administrator and local machine administrator permissions.) Review the DCDiag log file you specified for any errors or warnings.

 DCDiag Tool

6. Run NetDiag to test network connectivity. (Your account must have local machine administrator permissions.) Review the NetDiag log file for any errors or warnings.

 NetDiag Tool
7. Review the ExDeploy, DCDiag, and NetDiag log files for any errors or warnings. | ExDeploy Log File
Next


Coexistence with Exchange 5.5 - Phase 2

Exchange Server Deployment Tools

Coexistence with Exchange 5.5

Phase 1 - Phase 2 - Phase 3

Phase 2: Prepare Active Directory

Step | Reference
1. Run ForestPrep to extend the Active Directory schema for Exchange Server 2003. To run ForestPrep, your account must have the following permissions: Enterprise Administrator, Schema Administrator, Domain Administrator, and local machine administrator.
    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)

    Run ForestPrep now

ForestPrep
2. Run DomainPrep to prepare the domain for Exchange Server 2003. To run DomainPrep, your account must have Domain Administrator and local machine administrator permissions.
    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)

    Run DomainPrep now

 DomainPrep
3. Run OrgPrepCheck (Organization Preparation Checks) to validate schema extensions, domains, and security descriptors, and check domain controller permissions. To run OrgPrepCheck, your account must have the following permissions: Domain Administrator (with rights to view objects in Active Directory) and Exchange 5.5 administrator (with rights to view objects in the Exchange directory). If the Exchange 5.5 server is using an LDAP port other than the default of 389, enter the Exchange 5.5 server in the format <5.5 server>:<port number>.

    Exchange 5.5 server (required)
    Global catalog server
    Log file path
    Run OrgPrepCheck now

OrgPrepCheck
4. Review the ExDeploy.log file for errors and warnings. | ExDeploy Log File

5. Install Active Directory Connector on the server. To install ADC, your account must have the following permissions: Domain Administrator, Enterprise Administrator, and local machine administrator.

    Optional: Specify the path to ADC Setup
    (<drive>:\adc\i386\setup.exe)
    Run ADC Setup Now
6. Run ADC Tools:
    1. On the Start menu, point to Programs or All Programs, point to Microsoft Exchange, and then click Active Directory Connector.
    2. In the console tree, click ADC Tools.

    3. Follow the steps indicated in the ADC Tools pane. These steps lead you through the processes of scanning the directory, running Resource Mailbox Wizard, running Connection Agreement Wizard, and verifying synchronization.

      Note When setting up connection agreements and specifying the account that will be used to connect to the Windows Server, specify an account that is at least an Exchange View Only Admin. Also, ensure that the account is a local administrator on the ADC server and a member of the domain in which the ADC server is installed.

ADC Tools Log File
7. Wait for objects to replicate to Active Directory. Then use the Verify option in step 4 of ADC Tools to verify that objects have replicated.
Next


Coexistence with Exchange 5.5 - Phase 3

Exchange Server Deployment Tools

Coexistence with Exchange 5.5

Phase 1 - Phase 2 - Phase 3

Phase 3. Installing Exchange Server 2003 on the Initial Server

Steps | Reference
1. Run SetupPrep to determine whether DNS is functioning, to check the versions of Exchange that are running on each server, and to verify the conversion of public folder access control lists (ACLs). To run SetupPrep, your account must have the following permissions: Domain Administrator (with rights to view objects in Active Directory) and Exchange 5.5 administrator (with rights to view objects in the Exchange directory).

If the Exchange 5.5 server is using an LDAP port other than the default of 389, enter the Exchange 5.5 server in the format <5.5 server>:<port number>.

    Exchange 5.5 server (required)
    Global catalog server
    Log file path
    Run SetupPrep now

SetupPrep Tool Group
2. Review the ExDeploy.log and orgnamecheck.log files for any errors or warnings. ExDeploy Log File
OrgNameCheck Tool

3. Install Exchange Server 2003 on the new server by running Exchange Setup. To install Exchange, your account must have the following permissions: Full Exchange Administrator (at the organization level), Exchange 5.5 Admin under the organization, site, and configuration nodes, and local machine administrator. If ADC Tools have not been run, Setup will stop.

Important During Setup, ensure that you select Join an existing 5.5 organization. If you select Create a new organization, you will create an Exchange organization that does not function with Exchange 5.5.

    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)
    Run Setup now

4. After setup, change your connection agreements to connect to the new server running Exchange 2003. The new server runs Site Replication Service (SRS); connecting to this server prevents problems with directory replication and Global Address List viewing. | Configuring Connection Agreements to Use the New Server

5. Validate the installation by running the ADCConfigCheck, ConfigDSInteg, RecipientDSInteg, and PrivFoldCheck tools. To run these tools, your account must have the following permissions: Domain Administrator (with rights to view objects in Active Directory) and Exchange 5.5 administrator (with rights to view objects in the Exchange directory).

    Go to the validation tools now

The installation of the first server is complete. To install Exchange 2003 on additional servers, click Next.

Next


Tools for Validating Exchange 5.5 and Exchange 2003 Coexistence

Steps Reference
Enter the Exchange 5.5 server, global catalog server, and log file path to be used by all tools on this page. If the Exchange 5.5 server is using an LDAP port other than the default of 389, enter the Exchange 5.5 server in the format <5.5 server>:<port number>.

    Exchange 5.5 server (required)
    Global catalog server
    Log file path
Run ADCConfigCheck (Configuration Object Check) to ensure that Exchange 5.5 directory configuration objects were properly replicated from the Exchange 5.5 directory to Active Directory. Your account must have Domain Administrator permissions (with rights to write to Active Directory) and Exchange 5.5 Administrator permissions (with rights to view objects in the Exchange directory).

    Run ADCConfigCheck now

ADCConfigCheck
Run ConfigDSInteg (Exchange Server 2003 Configuration Object Checks) to perform E2KDSInteg configuration object checks on Active Directory configuration objects. Your account must have Domain Administrator permissions (with rights to view objects in Active Directory).

    Run ConfigDSInteg now

ConfigDSInteg
Run RecipientDSInteg (Exchange Recipient Object Check) to check recipient objects in Active Directory. Your account must have Domain Administrator permissions (with rights to view objects in Active Directory).

    Run RecipientDSInteg now

RecipientDSInteg
Run PrivFoldCheck (Private Folder Check), which uses the Exchange 5.5 DS/IS consistency adjuster to ensure the successful conversion of mailbox access control lists (ACLs). Your account must have Exchange 5.5 Administrator permissions (with rights to view objects in the Exchange directory).

    Run PrivFoldCheck now

PrivFoldCheck
Review the ExDeploy.log. ExDeploy Log File

Return to Phase 3. Installing Exchange Server 2003 on the Initial Server .


Upgrade from Exchange 2000 Native Mode

Steps | Reference
1. If you are upgrading a server running Windows 2000, install the latest service pack. If you are installing a new server, install Windows 2000 Server SP3 or later, Windows 2000 Advanced Server SP3 or later, or Windows Server 2003. | Operating System and Active Directory Requirements
2. Verify that the NNTP, SMTP, and World Wide Web services are installed and enabled on the server. If you are running Windows Server 2003, verify that ASP.NET is installed. | Enabling Windows Services

3. If you are upgrading the server from Exchange 2000, remove the following components if they were previously installed on the server:

  • Microsoft Mobile Information Server Exchange Event Sink. (Exchange 2003 contains the Exchange Mobile Browse component.)
  • Instant Messaging Server, Chat, Key Management Server, Lotus cc:Mail connector, and MS Mail connector. (These components are not supplied in Exchange 2003. If you wish to retain these services in your organization, you should not install Exchange 2003 on servers running these components.)

4. Install the Windows 2000 SP3 or Windows 2003 version of the Windows Support Tools from the Support folder on the Windows compact disc. Be sure to install the version that matches the operating system of the server. DCDiag (Domain Controller Diagnostics) and NetDiag (Network Connectivity Tester) are included in the Windows Support Tools.

5. Run DCDiag to test network connectivity and DNS resolution. To run the DCDiag tool, your account must have Domain Administrator and local machine administrator permissions. Review the DCDiag log file you specified for any errors or warnings.

 DCDiag Tool

6. Run NetDiag to test network connectivity. To run the NetDiag tool, your account must have local machine administrator permissions. Review the NetDiag log file for any errors or warnings.

 NetDiag Tool

7. Run ForestPrep to extend the Active Directory schema for Exchange Server 2003. To run ForestPrep, your account must have the following permissions: Enterprise Administrator, Schema Administrator, Domain Administrator, and local machine administrator.

    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)
    Run ForestPrep now

ForestPrep
8. Run DomainPrep to prepare the domain for Exchange 2003. To run DomainPrep, your account must have Domain Administrator and local machine administrator permissions.

    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)
    Run DomainPrep now

DomainPrep
9. Upgrade the server to Exchange Server 2003 by running Exchange Setup. To install Exchange Server 2003, your account must have the following permissions: Full Exchange Administrator (at the organization level) and local machine administrator.

    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)
    Run Setup now

The upgrade of this server is complete. To install Exchange 2003 on additional servers, click Next.

Next


Coexistence with Mixed Mode Exchange 2000 and Exchange 5.5

To upgrade an Exchange environment in which Exchange 2000 and Exchange 5.5 already coexist, you must upgrade each instance of Active Directory Connector (ADC) to the Exchange Server 2003 version. To verify that your connection agreements are set up properly, use the ADC Tools that are supplied by the Exchange 2003 version of ADC.

Important The ADC Tools provide recommendations for connection agreements based on your directory configuration. To prevent directory replication problems, it is strongly recommended that you accept these recommendations.

After you have upgraded all versions of Active Directory Connector, you can upgrade your Exchange 2000 servers to Exchange Server 2003.

For a list of prerequisites, see Exchange 5.5 Coexistence Prerequisites.

To begin, select one of the following options.

  1. Upgrade Active Directory Connector Servers You must upgrade all instances of Active Directory Connector Manager before you upgrade other Exchange 2000 servers. Repeat this option for each server running Active Directory Connector.
  2. Install or Upgrade the First Exchange Server After you have upgraded all instances of Active Directory Connector, you can install the first Exchange 2003 server or upgrade the first Exchange 2000 server to Exchange 2003.


Upgrading Active Directory Connector Servers

Exchange Server Deployment Tools

Upgrade Active Directory Connector Servers

Step | Reference
1. Review the Exchange 5.5 coexistence prerequisites. | Exchange 5.5 Coexistence Prerequisites

2. Run ForestPrep to extend the Active Directory schema for Exchange Server 2003. Note that you must run ForestPrep in the domain where the schema master resides. To run ForestPrep, your account must have the following permissions: Enterprise Administrator, Schema Administrator, Domain Administrator, and local machine administrator.

    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)
    Run ForestPrep now

ForestPrep
3. Run DomainPrep to prepare the domain for Exchange 2003. If Exchange is running in additional domains in the forest, run DomainPrep in each of these domains. To run DomainPrep, your account must have Domain Administrator and local machine administrator permissions.

    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)
    Run DomainPrep now

 DomainPrep

4. Upgrade Active Directory Connector on the server. To upgrade ADC, your account must have the following permissions: Domain Administrator, Enterprise Administrator, and local machine administrator.

In Setup, under the Action column, select Reinstall.

    Optional: Specify the path to ADC Setup
    (<drive>:\adc\i386\setup.exe)
    Run ADC Setup Now

5. Repeat step 4 for each server running Active Directory Connector.
6. On one of the Active Directory Connector servers, run ADC Tools to ensure that the proper connection agreements are configured. To run ADC Tools:

    1. On the Start menu, point to Programs or All Programs, point to Microsoft Exchange, and then click Active Directory Connector.
    2. In the console tree, click ADC Tools.

    3. Follow the steps indicated in the ADC Tools pane. These steps lead you through the process of scanning the directory, running Resource Mailbox Wizard, running Connection Agreement Wizard, and verifying synchronization.

      Note When setting up connection agreements and specifying the account that will be used to connect to the Windows Server, specify an account that is at least an Exchange View Only Admin. Also, ensure that the account is a local administrator on the ADC server and a member of the domain in which the ADC server is installed.

 ADC Tools Log File

Active Directory Connector upgrade is complete. To install the first Exchange 2003 server or upgrade the first Exchange 2000 server, click Next.

Next


Install or Upgrade the First Exchange Server

Steps | Reference
1. If you are upgrading a server running Windows 2000, install the latest Windows 2000 service pack. If you are installing a new server, install Windows 2000 Server SP3 or later, Windows 2000 Advanced Server SP3 or later, or Windows Server 2003. | Operating System and Active Directory Requirements
2. Verify that the NNTP, SMTP, and World Wide Web services are installed and enabled on the server. | Enabling Windows Services
3. If you are upgrading the server from Exchange 2000, remove the following components if they were previously installed on the server:
  • Microsoft Mobile Information Server Exchange Event Sink. (Exchange 2003 contains the Exchange Mobile Browse component.)
  • Instant Messaging Server, Chat, and Key Management Server, Lotus cc:Mail connector, and MS Mail connector. (These components are not supplied in Exchange 2003. If you wish to retain these services in your organization, you should not install Exchange 2003 on servers running these components.)
4. Install the Windows 2000 SP3 or Windows 2003 version of the Windows Support Tools from the Support folder on the Windows compact disc. Be sure to install the version that matches the operating system of the server. DCDiag (Domain Controller Diagnostics) and NetDiag (Network Connectivity Tester) are included in the Windows Support Tools.
5. Run DCDiag to test network connectivity and DNS resolution. To run the DCDiag tool, your account must have Domain Administrator and local machine administrator permissions. Review the DCDiag log file you specified for any errors or warnings.

 DCDiag Tool
6. Run NetDiag to test network connectivity. To run the NetDiag tool, your account must have local machine administrator permissions. Review the NetDiag log file for any errors or warnings. | NetDiag Tool

7. Install Exchange Server 2003 on the server by running Exchange Setup. To install Exchange Server 2003, your account must have the following permissions: Full Exchange Administrator (at the organization level), Exchange 5.5 Administrator (at the organization, site, and configuration level in the Exchange 5.5 directory), and local machine administrator. You will also need to know the Exchange 5.5 service account and password.

    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)
    Run Setup now

The upgrade of this server is complete. To install Exchange 2003 on additional servers, click Next.

Next


Install Exchange 2003 on Additional Servers

Steps | Reference
1. On the server, install Windows 2000 Server SP3 or later, Windows 2000 Advanced Server SP3 or later, or Windows Server 2003. | Operating System and Active Directory Requirements
2. Verify that the NNTP, SMTP, and World Wide Web services are installed and enabled on the server. If you are running Windows Server 2003, verify that ASP.NET is installed. | Enabling Windows Services

3. Install the Windows 2000 SP3 or Windows 2003 version of the Windows Support Tools from the Support folder on the Windows compact disc. Be sure to install the version that matches the operating system of the server. DCDiag (Domain Controller Diagnostics) and NetDiag (Network Connectivity Tester) are included in the Windows Support Tools.

4. Run DCDiag to test network connectivity and DNS resolution. To run the DCDiag tool, your account must have Domain Administrator and local machine administrator permissions. Review the DCDiag log file you specified for any errors or warnings.

 DCDiag Tool

5. Run NetDiag to test network connectivity. To run the NetDiag tool, your account must have local machine administrator permissions. Review the NetDiag log file for any errors or warnings.

 NetDiag Tool

6. If there are no existing Exchange 2003 servers in the domain, run DomainPrep to prepare the domain for Exchange 2003. To run DomainPrep, your account must have Domain Administrator and local machine administrator permissions.

    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)

    Run DomainPrep now

 DomainPrep
7. Install Exchange Server 2003 on the new server by running Exchange Setup. To install Exchange Server 2003, your account must have the following permissions: Full Exchange Administrator (at the administrative group level), local machine administrator, and Exchange 5.5 site administrator (if you are installing Exchange 2003 in an Exchange 5.5 site).

    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)
    Run Setup now

8. Repeat the above steps for each server on which you want to install Exchange 2003.

Installation of Exchange Server 2003 is complete. To complete the post-installation steps, click Next.

Next


Install Exchange System Management Tools Only

You can administer Exchange servers from a Windows computer by using Exchange Setup to install only Microsoft Exchange System Management Tools.

Note If you have not installed an Exchange 2003 server in your organization, you must first run ForestPrep. ForestPrep extends the Active Directory schema to include Exchange-specific classes and attributes, and creates the container object for the Exchange organization in Active Directory.

To install Exchange System Management Tools
  1. Ensure that the computer meets the following requirements:
    • The computer is running Windows XP, Windows Server 2003, Windows 2000 Professional, or Windows 2000 Server SP3.
    • The computer name does not contain unsupported characters.
    • The language version matches any previous installation of Exchange 2000 System Management Tools (except for upgrades from English to Korean, Traditional Chinese, or Simplified Chinese).
  2. Log onto the domain with an account that has local machine administrator permissions.
  3. Depending on the version of Windows that is running on the computer, install the required services.
    Windows Version Required Services
    Windows XP Service Pack 1 (SP1)
    • Internet Information Services Snap-In component
      (In Control Panel, Add/Remove Programs, Add/Remove Windows Components)
    • SMTP Service component
    • World Wide Web Service
    • Windows Server 2003 Administration Tools Pack, AdminPak.msi
    Windows XP SP2
    • Internet Information Services Snap-In component
    • Windows Server 2003 Administration Tools Pack (AdminPak.msi)
    Windows Server 2003
    • Internet Information Services Manager component
    Windows 2000 Professional SP3
    • Internet Information Services Snap-In component
    • Windows Server 2003 Administration Tools Pack (AdminPak.msi)
    Windows 2000 Server SP3
    • Internet Information Services Snap-In component
    • Windows Server 2003 Administration Tools Pack (AdminPak.msi)
    • SMTP Service component
    • NNTP Service component

  4. Run Exchange Setup. On the Component Selection page, set the installation action to Custom, and then select Microsoft Exchange System Management Tools.

    Optional: Specify a path to Setup (<drive>:\setup\i386\setup.exe)

    Run Setup now

  5. After running Setup, disable SMTP Service, WWW Service, or NNTP Service if you do not intend to run them on the computer.


New Exchange 2003 Installation

Steps | Reference
1. On the server, install Windows 2000 Server SP3 or later, Windows 2000 Advanced Server SP3 or later, or Windows Server 2003. | Operating System and Active Directory Requirements
2. Verify that the NNTP, SMTP, and World Wide Web services are installed and enabled on the server. If you are running Windows Server 2003, verify that ASP.NET is installed. | Enabling Windows Services

3. Install the Windows 2000 SP3 or Windows 2003 version of the Windows Support Tools from the Support folder on the Windows compact disc. Be sure to install the version that matches the operating system of the server. DCDiag (Domain Controller Diagnostics) and NetDiag (Network Connectivity Tester) are included in the Windows Support Tools.

4. Run DCDiag to test network connectivity and DNS resolution. To run the DCDiag tool, your account must have Domain Administrator and local machine administrator permissions. Review the DCDiag log file you specified for any errors or warnings.

 DCDiag Tool

5. Run NetDiag to test network connectivity. To run the NetDiag tool, your account must have local machine administrator permissions. Review the NetDiag log file for any errors or warnings.

 NetDiag Tool

6. Run ForestPrep to extend the Active Directory schema for Exchange Server 2003. To run ForestPrep, your account must have the following permissions: Enterprise Administrator, Schema Administrator, Domain Administrator, and local machine administrator.

    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)
    Run ForestPrep now

ForestPrep
7. Run DomainPrep to prepare the domain for Exchange 2003. To run DomainPrep, your account must have Domain Administrator and local machine administrator permissions.

    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)
    Run DomainPrep now

 DomainPrep
8. Install Exchange Server 2003 on the new server by running Exchange Setup. To install Exchange Server 2003, your account must have the following permissions: Full Exchange Administrator (at the organization level) and local machine administrator.

    Optional: Specify a path to Setup
    (<drive>:\setup\i386\setup.exe)
    Run Setup now

The installation of the first server is complete. To install Exchange 2003 on additional servers, click Next.

Next


Configuring Connection Agreements to Use the New Server

After setup, change your connection agreements to connect to the new server running Exchange Server 2003. The new server runs Site Replication Service (SRS); connecting to this server prevents problems with directory replication and Global Address List viewing.

To configure connection agreements to use the new server

  1. Start Active Directory Connector Manager. (On the Start menu, point to Programs or All Programs, point to Microsoft Exchange, and then click Active Directory Connector.)
  2. Double-click a public folder or recipient connection agreement.
  3. Click the Connections tab.
  4. Under Exchange Server information, in Server, type the name of the new Exchange Server 2003. In Port, type 379, which is the port Site Replication Service (SRS) uses. Unlike other Exchange 5.5 directory services, SRS is hardcoded to respond to LDAP requests only on port 379.
  5. Click OK.
  6. Under Connect As, click Modify. Then type the name and password for the account that is a member of the Exchange 5.5 Administrators group and has Exchange View Only Administrator rights (at a minimum) in Exchange Server 2003.
  7. Repeat these steps for each connection agreement that connects to a server in the Exchange 5.5 site.


Deploying the First Exchange 2003 Server

Exchange Server Deployment Tools

Deploy the First Exchange 2003 Server

To begin, select the appropriate deployment process based on your current environment.

    If this is your current environment | Follow this process
You are running Exchange 5.5 and have not yet connected Exchange to Active Directory. | Coexistence with Exchange 5.5
You are running Exchange 2000 and Exchange 5.5, and you are using Active Directory Connector (ADC) to synchronize the directories. | Coexistence with Mixed Mode Exchange 2000 and Exchange 5.5
You are running Exchange 2000 in native mode and you want to upgrade a server or install the first new Exchange 2003 server. | Upgrade from Exchange 2000 Native Mode
You are not running Exchange. | New Exchange 2003 Installation


Optimizing Memory Usage

The Store.exe process addresses a finite amount of memory, known as virtual address space. Virtual address space usage affects a mailbox server's overall performance and scalability. When virtual memory runs low, performance decreases dramatically. Although Exchange 2003 automatically optimizes usage for small- to medium-sized servers, additional tuning is necessary for servers with more than 1 GB of physical memory.

Monitoring Memory Usage

You can monitor the Event Viewer Application Log and Performance Logs and Alerts (Performance on the Administrative Tools submenu) for virtual memory problems. In the Application Log, a 9582 warning appears when the largest free block of virtual memory decreases to 32 MB. If you see this, you should restart the Exchange store process at the next opportunity. If the largest block decreases to 16Mb, a 9582 error appears; this means the server could fail, and you should restart the server. Failure to act on these events could result in sporadic mail delivery and IMAIL conversion failures (12800 events).

In Performance Logs and Alerts, monitor the following counters:

  • VM Largest Block Size counter in the MSExchangeIS object. A healthy server has more than 200,000,000 bytes (200 MB) as the largest free block. If the value is lower, you should carefully monitor the server.
  • Pool Pages Bytes in the Memory Object. Amounts greater than 200 MB indicate a problem (except when backups are running; during backups, each page in the cache manager is backed by a pool page).
  • Pool Nonpaged Bytes in the Memory Object. Amounts greater than 100 MB indicate a problem.
  • Free System Page Table Entries in the Memory Object. Amounts less than 3000 indicate a problem.
  • Working Set in the Process Object. An upward trend indicates a potential memory leak.

If a server shows signs of low virtual address space, you should adjust the following settings. If these settings are not optimized for Exchange, event 9665 will appear in Event Viewer.

  • If the server is running Windows 2000 Advanced Server or Windows Server 2003 and has 1 GB or more of physical memory, set the /3GB switch in the Boot.ini file.
  • If the server is running Windows Server 2003 (any edition), configure USERVA and System Pages. If the server is running Windows 2000, ensure that Windows 2000 SP3 or later is installed.
  • If the server has 1 GB or more of physical memory, set the HeapDeCommitFreeBlockThreshold registry parameter.
  • Tune the Store Database Cache Size if necessary.

Event 9665

Exchange performs an optimal memory configuration check when the store process starts. If the memory settings are not optimal, you will see event 9665 in Event Viewer. This message appears in the following instances:

  • The server is running Windows 2000 and the SystemPages value in the registry is set outside the range of 24000 to 31000.
  • The server has 1 GB of memory or more and does not have the /3GB switch.
  • The server is running Windows Server 2003, has 1 GB of memory or more and the /3GB switch is set, but the /USERVA setting is not present or is outside the range of 3030 to 2970.

If you see this event, check the SystemPages and HeapDeCommitFreeBlockThreshold settings in the registry, as well as the /3GB switch and the USERVA setting in the boot.ini file. The following sections contain recommendations for each of these settings.

Note If you want to turn off the memory configuration check, you can create the following registry key.

    Path | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem\
Parameter | Suppress Memory Configuration Notification
Type | REG_DWORD
Setting | 1

Note The memory configuration check does not occur on servers running Microsoft Small Business Server.

Setting the /3GB Switch

By default, Windows 2000 Advanced Server and Windows Server 2003 allocate 2 GB of virtual address space to user mode processes such as Store.exe. If a server has 1 GB or more of physical memory, set the /3GB switch in the Boot.ini file to increase virtual address space. For more information, see Microsoft Knowledge Base article 266096, XGEN: Exchange 2000 Requires /3GB Switch with More Than 1 Gigabyte of Physical RAM.

Important The /3GB switch is designed for Windows 2000 Advanced Server and all editions of Windows Server 2003. Do not set the /3GB switch in Windows 2000 Standard Edition.

Configuring USERVA and SystemPages

If the server is running Windows 2000, you should set the SystemPages registry key to a value between 24000 and 31000. The SystemPages registry key is located in the following path:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\SystemPages

If the server is running Windows Server 2003, set the SystemPages value to zero, and set the /USERVA=3030 parameter in the Boot.ini file. This allows for more system page table entries on the server, which is critical for scale-up systems.

Setting the HeapDeCommitFreeBlockThreshold Registry Key

The HeapDeCommitFreeBlockThreshold registry key controls the amount of free space that is required before the heap manager decommits memory. The default is zero, which means that the heap manager decommits each 4 KB page that becomes available. Over time, virtual address space can become fragmented. On servers that have 1 GB or more of physical memory, you can set the registry key to a higher value to reduce or eliminate fragmentation. Set the registry key as shown in the table below, and then restart the server. For more information, see Microsoft Knowledge Base article Q315407, XADM The 'HeapDeCommitFreeBlockThreshold' Registry key.

Path | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
Parameter | HeapDeCommitFreeBlockThreshold
Type | REG_DWORD
Default | Zero
Recommended setting | 0x00040000

Adjusting the Store Database Cache Size

The store database cache (also referred to as the ESE buffer) caches database transactions before they are committed to the database. By default, Exchange 2003 allocates 896 MB if the /3GB switch is set on the server and 576 MB if the /3GB option is not set. In the following instances, adjusting the maximum buffer size can increase performance:

  • If the server is running Exchange 2003 and other server-side applications, reduce the buffer to limit the use of memory by Exchange.
  • On servers with more than 2 GB of memory, increase the size of the buffer (up to a maximum of 1200 MB).

Before you increase the maximum buffer size, use Performance Logs and Alerts to monitor the store instance of the Virtual Bytes counter (in the Process object) under normal load. This counter shows the current size (in bytes) of the virtual address space used by the Store.exe process. The value should be below 2.8 GB if the /3GB switch is set and below 1.8 GB if the /3GB switch is not set. If the values are higher, do not increase the maximum buffer size. If the values are lower, you can increase the maximum buffer size up to 1,200 MB. For example, if the /3GB switch is set, and the virtual bytes count is 2.5 GB under heavy load, you can increase your maximum buffer size by approximately 300 MB.

Be aware that on servers experiencing address space issues, increasing the buffer size may negatively impact server performance. A larger buffer means more virtual address space consumption; increasing the buffer may result in system instability.

To adjust the maximum buffer size, use ADSI Edit to modify the msExchESEParamCacheSizeMax value. (See Microsoft Knowledge Base article 266768, XSTR: How to Modify the Store Database Maximum Cache Size.) After you set the value, wait for Active Directory replication to replicate the value throughout the forest. Then restart the Microsoft Exchange Information Store service.

Important Be careful not to select msExchESEParamCacheSizeMin.

The following table summarizes maximum buffer size default values and recommendations. The value is expressed as a page count and should be set to an exact multiple of 8192 for maximum efficiency.

Default size on /3GB servers | 229376 (896 MB)
Default size on non /3GB servers | 147456 (576 MB)
Recommended maximum | 307200 (1.2Gb)
Very large, address-space constrained servers | 196608 (768Mb)


Post-Installation Steps

When you have finished upgrading your servers to Exchange Server 2003, follow the appropriate post-installation steps.

Moving Mailboxes

If mailboxes are currently stored on an Exchange 5.5 server, move mailboxes from the Exchange 5.5 server to an Exchange 2003 server in the same Exchange site. Repeat this process for all the mailboxes that you want to move. If you want to move several mailboxes simultaneously, you can select all of the mailboxes and move them together. After you have successfully moved your mailboxes from Exchange 5.5 to Exchange Server 2003, perform a full online backup of the new Exchange Server 2003 database.

Moving System Folders and Public Folders

Use the Microsoft Exchange Public Folder Migration Tool to move system folders and public folders from the Exchange 5.5 server to an Exchange 2003 server.

Optimizing Memory Usage

For servers that have more than 1 GB of physical memory, follow the guidelines for optimizing memory usage. By taking the recommended steps, you can ensure that Exchange uses virtual address space and the store database cache as efficiently as possible.

Using Internet Mail Wizard

Use Internet Mail Wizard to configure Internet e-mail delivery in your organization.

Configuring RPC Over HTTP

Exchange Server 2003, in combination with Windows Server 2003 and Outlook 2003, supports RPC over HTTP. This feature allows remote users running Outlook 2003 to connect over the Internet to Exchange servers in the corporate environment, eliminating the need to use a virtual private network (VPN). When you deploy RPC over HTTP, you configure your Exchange front-end server to act as an RPC Proxy server. For detailed information, see the "Exchange 2003 Client Access Guide" at http://www.microsoft.com/exchange/library.

Subscribing to the the Microsoft Security Notification Service

Subscribing to the the Microsoft Security Notification Service ensures that you receive immediate notification of security bulletin releases for any Microsoft product. As an Exchange administrator, it is important that you keep up-to-date on security bulletins and hotfixes that can affect your Exchange servers. To subscribe, go to Product Security Notification.

You have completed the deployment of Exchange Server 2003.

Get latest Exchange content at http://www.microsoft.com/exchange/library.
Send feedback about this page Send feedback about Exchange Server Deployment Tools.


Configure Internet E-Mail Delivery

Exchange 2003 provides Internet Mail Wizard to guide you through the process of configuring Internet e-mail delivery in your organization. You can use the wizard to configure an Exchange 2000 or Exchange 2003 bridgehead server to send Internet e-mail, receive Internet e-mail, or both.

Note You cannot run Internet Mail Wizard on an Exchange server if you have created additional SMTP virtual servers or created SMTP connectors.

To run Internet Mail Wizard

  1. On the Start menu, point to Programs or All Programs, point to Microsoft Exchange, and then click System Manager.
  2. Right-click your Exchange organization, and then click Internet Mail Wizard.
  3. Follow the instructions in the wizard.

Return to Post-Installation Steps.


ADC Tools Log File

The ADCTools.log file is generated when you run ADC Tools in Active Directory Connector. The ADCTools.log file is saved in the directory you specify when you run ADC Tools.

The majority of the messages that appear in the ADCTools.log file also appear in the Information box in ADC Tools. In addition to informational messages, the errors and warning listed in the following table may appear.

Error or Warning Message | Corrective Action
Error: The Data Collection tool found customized object matching rules in the ADC Management properties. ADC Tools cannot be used when customized matching rules exist. | If you have specified the attributes that Active Directory Connector replicates between the Exchange 5.5 directory and Active Directory and you want to retain these custom matching rules, you must set up your connection agreements manually.
Warning: Data Collection found resource mailboxes that are mismatched or missing a master account SID. Use the following Microsoft Knowledge Base articles to resolve problems, and then rerun Step 2: Q256862, "XADM: How to Correct Mismatched Accounts After Active Directory Connector Replication"; Q278966, "XADM: Unable to Move or Log On to Exchange Resource Mailbox." | See Microsoft Knowledge Base articles 256862 and 278966.
Warning: The Data Collection tool found mail-enabled users, contacts, or groups that are not replicated from Active Directory to the Exchange 5.5 directory. Running the Connection Agreement Wizard in Step 4 will resolve these issues. | Run Connection Agreement Wizard and allow time for directory replication to complete.
Warning: The Data Collection tool found objects that are not replicated from the Exchange 5.5 directory to Active Directory. Running the Connection Agreement Wizard in Step 4 will resolve these issues. | Run Connection Agreement Wizard and allow time for directory replication to complete.
There may be a problem with network or LDAP connectivity. Check network connections and run the Resource Mailbox Wizard again. | Ensure that you have specified the correct Exchange 5.5 server and that you have specified the LDAP port number that the server is using. Ensure that the server is available and the network connections are functioning. Then run Resource Mailbox Wizard again.
Warning: The Exchange 5.5 directory still contains objects that are not replicated to Active Directory. | If you have just run Connection Agreement Wizard, allow time for directory replication to complete.
Warning: Active Directory still contains objects that are not replicated to the Exchange 5.5 directory. | If you have just run Connection Agreement Wizard, allow time for directory replication to complete.


ExDeploy Log File

The deployment tools generate log files in the ExDeploy Logs directory or in the directory you specify. The primary log file is the ExDeploy log file, ExDeploy.log, which updates each time you run a deployment tool. The ExDeploy.log file lists the tools that returned any errors or warnings. Several of the deployment tools generate summarized information that is also contained in the ExDeploy.log file.

Important If you have entered a log file path but you do not see log files in the directory you specified, you may have entered an invalid path. Verify the log file path and run the tool again. If the log file contains a large number of errors or warnings, ensure that the server you specified in Global Catalog server is a global catalog server and not a domain controller.

ExDeploy.log Errors and Warnings

The tables below provide corrective action for errors or warnings that may appear in the ExDeploy.log file. The ExDeploy.log file is divided into sections that represent the phases of deployment. Use the section headings in the ExDeploy.log file to determine which table to reference.

Planning Your Deployment (DSScopeScan) Section in ExDeploy.log

Tool Source | Message | Corrective Action
(multiple) | Warning: Either you do not have permission to view hidden objects in the Exchange 5.5 directory, or the directory is not Exchange 5.5 SP1 or later. Returned information may be inaccurate. | Ensure that your account has the View Only Admin role (at a minimum) in the Exchange 5.5 directory under the organization, site, and configuration nodes. Ensure that the specified Exchange server is running Exchange 5.5 SP3 or a later version. If access is still denied, add the current Active Directory account to the Exchange 5.5 server's Local Administrators group.
DSConfigSum | Error: Server '%1' has no associated public folder store. | On the server indicated, associate a public folder store with each mailbox store. To do this, on the mailbox store's Properties, on the General tab, specify a public folder store under Default public store. If you are using a separate server as the dedicated public folder server, specify the dedicated server's public folder store. Otherwise, create a new public folder store within the storage group, and specify this new public folder store.
DSObjectSum | Error: DSObjectSum encountered error %1 counting public folders. | Run DSObjectSum again. If the error persists, note the error code and contact Microsoft Product Support Services.
DSObjectSum | Error: DSObjectSum encountered error %1 counting distribution lists. | Run DSObjectSum again. If the error persists, note the error code and contact Microsoft Product Support Services.
DSObjectSum | Error: DSObjectSum encountered error %1 counting custom recipients. | Run DSObjectSum again. If the error persists, note the error code and contact Microsoft Product Support Services.
UserCount | Exchange 5.5 Directory User Count encountered error %1 counting mailboxes. | Run UserCount again. If the error persists, note the error code and contact Microsoft Product Support Services.
VerCheck | Warning: One or more sites cannot be converted to Exchange Server 2003 or later until a server is upgraded to 5.5 SP3 or later. | Each site in your existing organization must contain at least one server running Exchange 5.5 SP3 or later to allow synchronization between the Exchange 5.5 directory and Active Directory. Upgrade at least one server in the site to Exchange Server 5.5 SP3 or later. To facilitate deployment, the server you upgrade should host the Exchange 5.5 mailboxes and should be located in the same Exchange 5.5 site as the new server that will host the Exchange Server 2003 mailboxes.
Netdiag | Warning: Netdiag found a potential problem on the local computer. | There may be a problem with network or LDAP connectivity. Consult the exdeploy-netdiag.log file for specific tests that failed. Check network connections, and then run Netdiag again.
OrgNameCheck | OrgNameCheck completed successfully. | This message indicates that OrgNameCheck ran successfully and no issues were found.
OrgNameCheck | Error: Site Addressing generation rules '%1' for SMTP in site '%2' in the Exchange 5.5 directory do not follow the rules for Domain Names in RFC 2821. Mail may not be routable after the upgrade. Please check the Site Addressing object and correct the SMTP address generation property. | In the Exchange 5.5 Administrator program, go to Site Addressing and remove any special characters from the SMTP type address (for example, remove "+" characters from domain names). If Exchange Server 2003 is installed, use Exchange System Manager to make the same changes to the SMTP address in the default recipient policy. Then run the Recipient Update Service again.
OrgNameCheck | Your organization name, or one or more site names, contains unsupported characters. | Use the Exchange 5.5 Administrator program to ensure that the display names of your organization and site-level objects do not contain special characters. For more information about the invalid characters, see Microsoft Knowledge Base article 289671.

Preparing Active Directory for Exchange Server 2003 (OrgPrepCheck) Section in ExDeploy.log

Source | Error or Warning Message | Corrective Action
PolCheck | Error: PolCheck found a problem with permissions given to Exchange servers in your Active Directory. | Refer to exdeploy-polcheck.log for domain controllers that do not have the Manage auditing and security logs privilege. If domain controllers have not received the privilege after replication, run DomainPrep again. If running PolCheck several times reveals that the privilege is removed from a domain controller, check for corrupt or custom group policies.
OrgCheck | Could not connect to the server '%1'. Please check the server name and port number. | Check the server name and the LDAP port number. Then run the tool again. For more information, see Microsoft Knowledge Base article 240078.
OrgCheck | Error in Initialize: %1. | Run the tool again. If the error persists, contact Microsoft Product Support Services.
OrgCheck | Error: OrgCheck could not find the Exchange configuration container '%1' in the Active Directory. | Ensure that you have the permissions required to access Active Directory (view-only permissions at a minimum). Ensure that Exchange has been installed successfully in the domain.
OrgCheck | Error: OrgCheck could not find the Exchange Domain Servers group '%1' in the Active Directory. | Verify that the group has been created and has not been removed from the Users container.
OrgCheck | Error: OrgCheck could not find the Exchange Enterprise Servers group '%1' in the Active Directory. | Verify that DomainPrep has been run successfully and that the Exchange Domain Servers and Exchange Enterprise Servers groups have not been removed from the Users container.
OrgCheck | Error: OrgCheck could not verify that the Exchange Server 2003 schema extensions are in the Active Directory. | Ensure that you have the permissions required to access Active Directory (view-only permissions at a minimum).
OrgCheck | Error: OrgCheck detected that either ForestPrep or DomainPrep have not been run yet in this domain, or that there is no available global catalog server in this domain. | The domain in which you install the initial server running Exchange Server 2003 must contain a global catalog server. Ensure that a global catalog server is located in the same Windows site and network segment as the new server. If a global catalog server already exists, ForestPrep or DomainPrep may have failed. First, reverse schema changes made by ForestPrep and DomainPrep; consult Microsoft Knowledge Base article 283027. Then run ForestPrep and DomainPrep again.
OrgCheck | Error: The Exchange Enterprise Servers group '%1' does not contain the Exchange Domain Servers group '%2'. | Verify that DomainPrep has been run successfully and that the Exchange Enterprise Servers group has not been removed from the Users container.
OrgCheck | The organization check of the Active Directory failed. | Run the OrgCheck tool again. If the error persists, contact Microsoft Product Support Services.
OrgCheck | Warning: The Exchange Domain Servers group '%1' does not contain the local computer '%2'. If the local computer is not running Exchange Server 2003, this is not a problem. | Exchange Server 2003 is not yet installed on the server. No action is required.

Exchange Installation Section in ExDeploy.log

VerCheck | Warning: One or more sites cannot be converted to Exchange Server 2003 or later until a server is upgraded to 5.5 SP3 or later. | Each site in your existing organization must contain at least one server running Exchange 5.5 SP3 or later to allow synchronization between the Exchange 5.5 directory and Active Directory. Upgrade at least one server in the site to Exchange Server 5.5 SP3 or later. To facilitate deployment, the server you upgrade should host the Exchange 5.5 mailboxes and should be located in the same Exchange 5.5 site as the new server that will host the Exchange Server 2003 mailboxes.
Netdiag | Warning: Netdiag found a potential problem on the local computer. | There may be a problem with network or LDAP connectivity. Consult the exdeploy-netdiag.log file for specific tests that failed. Check network connections and run Netdiag again.
PubFoldCheck | Error: PubFoldCheck detected an error while performing Public Folder DS/IS Consistency Adjustment on the Exchange 5.5 server. Check the Windows Application Event Log on that server for details. | On the Exchange 5.5 server against which this tool ran, check the application event log for events (where Type equals "Warning" or Error" and Source equals "MSExchangeIS Public") occurring near the time PubFoldCheck ran. If there is good RPC connectivity between your console and a server, you can access the server's event viewer by clicking Start, clicking Run, and then typing eventvwr \\<servername>.
PubFoldCheck | Error: PubFoldCheck failed. | Run PubFoldCheck again. If the error persists, contact Microsoft Product Support Services.
PubFoldCheck | Warning: PubFoldCheck discovered problems the last time it ran in your site. | The last time PubFoldCheck ran, it found that the directory and the information store were not synchronized. Inconsistencies between the directory and the information store occur when there is an entry for a public folder in the directory database without a corresponding entry in the information store, or vice versa. Run PubFoldCheck again before you run the Exchange Setup program.
PubFoldCheck | Warning: PubFoldCheck was not run in your site. | PubFoldCheck has not been run. It is highly recommended that you run PubFoldCheck before you run the Exchange Setup program. Running PubFoldCheck helps prevent errors that result from synchronization problems between the public folder store and the directory.

Note ExDeploy.log also contains output from tools that run automatically during Exchange Server 2003 setup. Refer to the previous sections for errors, warnings, and corrective action for the following tools:

  • OrgNameCheck Tool
  • NetDiag Tool
  • OrgCheck Tool
  • ADCUserCheck Tool
  • ADCObjectCheck Tool
  • PubFoldCheck Tool

Completing Deployment Section in ExDeploy.log

Source | Error or Warning Message | Corrective Action
ADCConfigCheck | Could not connect to the server '%1'. Please check the server name and port number. | Check the server name and the LDAP port number. Then run the tool again. For more information, see Microsoft Knowledge Base article 240078.
ADCConfigCheck | Error in Initialize: %1. | Run the tool again. If the error persists, contact Microsoft Product Support Services.
ADCConfigCheck | Error: Configuration object '%1' has not replicated to the Active Directory. | Either Active Directory Connector is not set up, or replication has not yet completed. Before you run ADCConfigCheck, set up Active Directory Connector and allow enough time for all objects to be replicated. Then run ADCConfigCheck again.
ADCConfigCheck | The following configuration objects were not properly replicated to the Active Directory: | Following this message is a list of Exchange 5.5 configuration objects that are missing from Active Directory. Ensure that you have the permissions required to write to Active Directory. For more details about the missing objects, review the adcconfigcheck.log file.
ADCConfigCheck | Warning: Either you do not have permission to view hidden objects in the Exchange 5.5 directory, or the directory is not Exchange 5.5 SP1 or later. Returned information may be inaccurate. | Ensure that your account has the View Only Admin role (at a minimum) in the Exchange 5.5 directory under the organization, site, and configuration nodes. Ensure that the specified Exchange server is running Exchange 5.5 SP3 or a later version. If access is still denied, add the current Active Directory account to the Exchange 5.5 server's Local Administrators group.
ADCConfigCheck | Warning: ADCConfigCheck detected that some configuration objects were not replicated from the Exchange 5.5 Directory to the Active Directory. | Review the adcconfigcheck.log file for a list of objects that were not replicated from the Exchange 5.5 directory to Active Directory.
ADCConfigCheck | There is no Microsoft Exchange organization object in the Active Directory. No Exchange 5.5 configuration objects could have been replicated to the Active Directory. The ADCConfigCheck will be skipped. | Ensure that the Active Directory forest contains a server running Exchange 5.5 SP3 or later.
PrivFoldCheck | Error: Could not retrieve server list of entire site from server %1. Cannot run private folder check of entire site. | Ensure that you have the permissions required to access Exchange (your account must be assigned the Admin or Permissions Admin role).
PrivFoldCheck | Error: One or more Exchange 5.5 servers returned errors from their Private Folder DS/IS Consistency Adjustment. Please check the Windows Application Event Log on these servers for details: | On the servers indicated, check the application event logs for events (where Type equals "Warning" or Error" and Source equals "MSExchangeIS Private") occurring near the time PrivFoldCheck ran. If there is good RPC connectivity between your console and a server, you can access the server's event viewer by clicking Start, clicking Run, and then typing eventvwr \\<servername>.
PrivFoldCheck | Error: PrivFoldCheck failed. | Run PrivFoldCheck again. If the error persists, contact Microsoft Product Support Services.
PrivFoldCheck | Error: PrivFoldCheck detected an error while performing Public Folder DS/IS Consistency Adjustment on the Exchange 5.5 server. Check the Windows Application Event Log on that server for details. | On the Exchange 5.5 server against which this tool ran, check the application event log for events (where Type equals "Warning" or Error" and Source equals "MSExchangeIS Private") occurring near the time PrivFoldCheck ran. If there is good RPC connectivity between your console and a server, you can access the server's event viewer by clicking Start, clicking Run, and then typing eventvwr \\<servername>.


Move Mailboxes

You must be logged on to the server with an account that has Exchange Administrator privileges in both the Exchange Server 2003 organization and the Exchange 5.5 site. The account must also be a member of the Account Operators group or the Domain Admins group.

To move mailboxes from the server running Exchange 5.5 to the Exchange Server 2003 mailbox stores

  1. On the Start menu, point to Programs or All Programs, point to Microsoft Exchange, and then click System Manager.
  2. Expand Administrative Groups, and then expand the site where the user accounts are located. Expand Servers, expand the Exchange 5.5 server, expand the storage group, and then click Mailboxes.
  3. Select the mailboxes you want to move.
  4. On the Action menu, click Exchange Tasks. In Welcome to the Exchange Task Wizard, click Next.

    Note This option is not available if you have not added Exchange System Manager to your console.

  5. In Available Tasks, click Move Mailbox, and then click Next.
  6. In Move Mailbox, select the Exchange Server 2003 server and the associated mailbox store to which you want to move the mailbox, and then click Next.
  7. In Task in Progress, you can watch as the mailbox moves. After the move is complete, click Next.
  8. In Completing the Exchange Task Wizard, review the list of mailboxes that moved successfully, and then click Finish.

When you are finished, check the application and system event logs for any Exchange-related errors.

Important If the mailboxes did not move successfully to the new server, you must delete any data that has transferred to the Exchange Server 2003 mailbox stores; then, if necessary, restore the mailboxes on the Exchange 5.5 computer. Then you can attempt to move the mailboxes again. For more information, see Microsoft Knowledge Base article 307350.

Return to Post-Installation Steps.


Move System Folders and Public Folders

Microsoft Exchange Public Folder Migration Tool (pfMigrate) allows you to create replicas of your system folders and public folders on the new Exchange 2003 server. After the system folders and public folders have replicated, you can use the pfMigrate tool to remove replicas from the source server. Unlike Exchange 5.5, it is not necessary to set a home server for a public folder in Exchange Server 2003. Any replica acts as the primary replica of the data it holds, and any public folder server can be removed from the replica list.

In order to use the pfMigrate tool, the source server and the target server you specify must be in the same routing group. The pfMigrate tool does not allow you to create replicas of your system folders and public folders across routing groups. This is because in mixed mode, moving folders across routing groups could prevent e-mail delivery to public folders.

To determine how many folders need to be replicated, you can use the pfMigrate tool to generate a report before you replicate folders. To determine whether the folders replicated successfully, you can generate the same report after you replicate folders.

To use the pfMigrate tool, ensure that you are logged on to the new Exchange server with an account that has the following privileges:

  • Exchange Administrator privileges in Exchange Server 2003
  • Exchange Administrator privileges in the Exchange 5.5 site
  • Administrator permissions on the Exchange public folders you want to move

Note After you use the pfMigrate tool to create system folder and public folder replicas on the new server, allow enough time for the folders to replicate before you remove replicas on the source server. To ensure that all replicas have been created, use the /R command option to generate a report.

Syntax

The pfMigrate tool is located in the ExDeploy folder on the Exchange Server 2003 compact disc (under Support Tools). Run the tool at the command prompt, either on a server or from the administrative console. Specify the command options by using the following syntax:

    pfMigrate.wsf
/S:<source server>
/T:<target server>
[/WMI:<server>]
[/N:<number of public folders>]
[/A]
[/D]
[/R]
[/F:<log file path>]
[/NNTP]
[/Y]
[/SYNC]
[/SF]

Examples

The following examples illustrate how you would use the pfMigrate tool.

Example 1

Public folders are currently stored on Exch55Srv, and you want to move them to Ex2003Serv; however, you first want to generate a report to determine the number of folders that must be replicated. To do this, you use the /R option of the pfMigrate tool because this option only generates a report and it does not replicate folders. In addition, you want to save the report in c:\PF_Status_01.log. Therefore, you run the following command.

    pfmigrate.wsf /S:Exch55Srv /T:Ex2003Serv /R /F:c:\PF_Status_01.log

Example 2

You want to move system folders from Exch55Srv to Ex2003Serv. In order for folders to replicate, you must use the /A option (to add the target server to the list of replicas) and the /N: option (to specify the number of folders to replicate at one time). Based on the report you generated, you decide to specify /N:10. You run the following command, and then wait for replication of the folders to complete.

    pfmigrate.wsf /S:Exch55Srv /T:Ex2003Serv /SF /A /N:10 /F:c:\PF_Status_01.log

Example 3

Now you want to move the public folders from Exch55Srv to Ex2003Serv. Based on the report you generated, you decide to move only 100 folders at a time. You run the following command, and then wait for replication of the folders to complete. Then you repeat this command until all folders have replicated.

    pfmigrate.wsf /S:Exch55Srv /T:Ex2003Serv /A /N:100 /F:c:\PF_Status_01.log

Example 4

After you run pfMigrate to create folder replicas on the target server, you want to remove the folders from the source server. First, you wait until the folder contents completely replicate. Then you run the following command to delete the replicated folders from the source folder.

    pfmigrate.wsf /S:Exch55Srv /T:Ex2003Serv /D

Command Options

The following table describes the pfMigrate command options.

Note The command options /A, /D, and /R cannot be specified together.

/S:<source server> | Name of the Exchange server where folders are currently replicated. Only folders with SOURCE on the replica list will be affected.
/T:<target server> | Name of the Exchange server where folders will be replicated to. Only folders without TARGET on the replica list will be affected.
/WMI:<server> | Name of the Exchange server that will provide WMI services. If not specified, the local machine will be used.
/N:<number of public folders> | Number of public folders to modify. This option limits the number of public folders updated by the script. If not specified, all affected folders will be updated. This is required in the Add mode, but optional in Delete mode.
/A | Adds the TARGET server to the replica list of folders where the SOURCE server is also a replica.
/D | Deletes the SOURCE server from the replica list of folders where the TARGET server is also a replica.
/R Run a report on the current status of the SOURCE server. Sample output:

    XXXX total
    XXXX of those Folders have a replica on SOURCE and no replica on TARGET
    XXXX of those Folders have a replica on both SOURCE and TARGET
/F:<log file path> | File where log information should be appended. If not specified, the default is pfmigrate.log on the current directory.
/NNTP | When specified, the script will not modify any of the folders in the Internet Newsgroups hierarchy of folders.
/Y | When specified, the script will not prompt for confirmation when running in Delete mode.
/SYNC | Executes the WMI query in synchronous mode.
/SF | Migrate System Folders: 'OFFLINE ADDRESS BOOK', 'EFORMS REGISTRY' and 'SCHEDULE+FREE BUSY'.

Return to Post-Installation Steps.


NetDiag Tool

NetDiag (Network Connectivity Tester) tests Domain Name System (DNS) functionality by performing a series of tests to check network connectivity.

Output

NetDiag sends output to the NetDiag.log file. NetDiag also runs automatically during Exchange Server 2003 Setup and sends output to the Exchange Server Setup Progress log at the root of the drive where you installed Exchange. The log indicates whether NetDiag ran successfully and includes any errors or warnings.

NetDiag.log

The NetDiag.log file lists the output from the NetDiag tool. Look for tests that failed and messages designated as "FATAL," and use this information to isolate network and connectivity problems.

Error or Warning Message | Corrective Action
Error: NetDiag failed. | The NetDiag tool failed to run. Verify that you are logged with an account that has Administrator permissions. If this error continues, install the Windows Support Tools from your Windows server compact disc, and then run NetDiag.exe from the command prompt.
Warning: NetDiag found a potential problem on the local computer. | There may be a problem with network or LDAP connectivity. Consult the exdeploy-netdiag.log file for specific tests that failed. Check network connections, and then run Netdiag again.


NTDSNoMatch Tool

In Exchange Server 2003, there is a one-to-one relationship between an object in Active Directory and an Exchange Server 2003 mailbox. In Exchange Server 5.5, however, multiple mailboxes can be associated with a user account, and multiple users can share a common mailbox. These situations are problematic for Active Directory Connector, which attempts to match an Exchange 5.5 mailbox to an Active Directory user object. When there are multiple mailboxes, Active Directory Connector processes them alphabetically and could associate the wrong mailbox with an Active Directory user object. To ensure that only the primary mailbox matches an Active Directory user object, identify resource mailboxes (that should not be matched to the user object) by setting Custom Attribute 10 (in the DS Site Configuration Custom Attributes) to NTDSNoMatch. Mailboxes with the NTDSNoMatch value are not matched to existing user accounts. Instead, they become new disabled user accounts in Active Directory.

The NTDSNoMatch tool automatically identifies resource mailboxes. NTDSNoMatch checks for user accounts that have multiple mailboxes and determines whether a mailbox is the primary mailbox or a resource mailbox. Then, for each site, it creates a comma-separated value (.csv) file that you can import directly into the Exchange 5.5 directory to set Custom Attribute 10 to NTDSNoMatch for the mailboxes identified.

It is highly recommended that you run NTDSNoMatch before you install Active Directory Connector. Run NTDSNoMatch alone or as part of the UserPrep tool group.

To run NTDSNoMatch, your account must have Exchange 5.5 administrator permissions (with rights to view objects in the Exchange directory).

Output

NTDSNoMatch sends output to the ExDeploy.log file and .csv files in the ExDeploy Logs directory (or the directory you specified when you ran the tools). NTDSNoMatch does not run automatically during Exchange Server 2003 Setup.

NTDSNoMatch.csv

NTDSNoMatch.csv is a comma-separated value file that lists mailboxes for which Custom Attribute 10 should be set to NTDSNoMatch. The list contains the mailbox display name and the Exchange 5.5 distinguished name for mailbox objects that have multiple user accounts. All sites are combined in this file.

Note Use this file to verify the mailboxes that have been identified by NTDSNoMatch tool. If any corrections need to be made, do not make them in this file. Instead, make corrections in the site-specific .csv files (below) before you import them.

<Sitename>.csv

NTDSNoMatch generates a separate <sitename>.csv file for each site. Each <sitename>.csv file lists recommendations for setting Custom Attribute 10 to NTDSNoMatch for an individual site. You can import these files directly into the Exchange 5.5 directory.

NtdsNoMatch.log

NtdsNoMatch.log indicates whether VerCheck ran successfully and includes the following errors or warnings if they occur.

Error or Warning Message | Corrective Action
#*** NTDSNoMatch: No mailboxes found. ***# | The NTDSNoMatch tool did not find any mailboxes in the Exchange 5.5 directory. If this is the expected result, no further action is necessary. If the Exchange 5.5 directory should contain mailboxes, you may not have the proper permissions to access the directory. Make sure you are logged on with an account that has Exchange 5.5 administrative permissions (view-only permissions at a minimum). Then run NTDSNoMatch again.
There is no associated Windows NT account (Assoc-NT-Account) for the mailbox: '%1'. | The Exchange 5.5 mailbox does not have a corresponding Windows NT account. If the NTDSNOMATCH attribute has been assigned to the mailbox, after the mailbox is replicated to Active Directory, it will be assigned the role of Self. If a user requires access to this mailbox, you must set up access rights manually.
#*** The security identifier (SID) was not found for the mailbox '%1'. The next entry will clear the SID. | The security ID for the indicated mailbox was not found. When you import this .csv file into the Exchange 5.5 directory, this will be removed from the directory. Verify that the mailbox should be removed. If the mailbox should not be removed, delete the entry that follows this message from the .csv file.
Warning: Either you do not have permission to view hidden objects in the Exchange 5.5 directory, or the directory is not Exchange 5.5 SP1 or later. Returned information may be inaccurate. | Ensure your account has the View Only Admin role (at a minimum) in the Exchange 5.5 directory under the organization, site, and configuration nodes. Ensure that the specified Exchange server is running Exchange 5.5 SP3 or a later version. If access is still denied, add the current Active Directory account to the Exchange 5.5 server's Local Administrators group.

ExDeploy.log

ExDeploy.log indicates whether NTDSNoMatch ran successfully and includes any errors or warnings that appear in NtdsNoMatch.log. (For more information, see ExDeploy Log File.)


OrgCheck Tool

OrgCheck performs the following functions:

  • Validates the schema extensions created by ForestPrep
  • Ensures that the proper domain groups exist and are populated
  • Ensures that the correct security descriptors are assigned
  • Confirms that the Exchange configuration container exists
  • Ensures that a global catalog server is available in a domain in which DomainPrep has been run
  • Ensures that a global catalog server is available in the same site as the Exchange Server 2003 server or a site directly adjacent to the Exchange Server 2003 server’s site

    Output

    OrgCheck sends output to the ExDeploy.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). OrgCheck also runs automatically during Exchange Server 2003 Setup and sends output to the Exchange Server Setup Progress log at the root of the drive where you installed Exchange. The log indicates whether OrgCheck ran successfully and includes any errors or warnings.

    For detailed information on OrgCheck errors, warnings, and corrective action that appear in ExDeploy.log, see ExDeploy Log File.


OrgNameCheck Tool

Organization and site names that contain special characters will cause Exchange Setup to fail. You should run OrgNameCheck (Organization and Site Name Check) to check for Exchange 5.5 organization and site names that do not comply with RFC 2821, which states the following:

  • All names may contain a maximum of 64 characters, with no leading or trailing spaces.
  • The LDAP display name must not contain the following characters:
      , = + < > # \ "
  • The display name (admin-display-name attribute) must not contain the following characters:
      ~ ! @ # $ % ^ & * ( ) _ + = { } [ ] | \ : ; " ' < , > . ? /

Output

OrgNameCheck sends output to the ExDeploy.log file and the orgnamecheck.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). OrgNameCheck also runs automatically during Exchange Server 2003 Setup and sends output to the Exchange Server Setup Progress log at the root of the drive where you installed Exchange. The log indicates whether OrgNameCheck ran successfully and includes any errors or warnings.

Orgnamecheck.log

The orgnamecheck.log file lists organization and site names and lists the following messages.

Message | Corrective Action
OrgNameCheck completed successfully. | This message indicates that OrgNameCheck ran successfully and no issues were found.
Error: The Exchange 5.5 organization or site display name '%1' contains a leading space, a trailing space, or one or more of the following unsupported characters: %2 | Use the Exchange 5.5 Administrator program to ensure that the display names of your organization and site-level objects do not contain special characters. For more information about the invalid characters, see Microsoft Knowledge Base article 289671.
Error: Site Addressing generation rules '%1' for SMTP in site '%2' in the Exchange 5.5 directory do not follow the rules for Domain Names in RFC 2821. Mail may not be routable after the upgrade. Please check the Site Addressing object and correct the SMTP address generation property. | In the Exchange 5.5 Administrator program, go to Site Addressing and remove any special characters from the SMTP type address (for example, remove "+" characters from domain names). If Exchange Server 2003 is installed, use Exchange System Manager to make the same changes to the SMTP address in the default recipient policy. Then run the Recipient Update Service again.
Error: Organization or Site Relative Distinguished Name (RDN) '%1' in the Exchange 5.5 directory does not follow the rules for Domain Names in RFC 2821. Mail may not be routable after the upgrade. Please check the Site Addressing object and make sure that the SMTP address generation follows RFC 2821 for domain names. | In the Exchange 5.5 Administrator program, go to Site Addressing and remove any special characters from organization and site names (for example, remove "+" characters from domain names). Use Exchange System Manager to make the same changes to the SMTP address in the default recipient policy. Then run the Recipient Update Service again. For more information about the invalid characters, see Microsoft Knowledge Base article 289671.
Error: Organization or Site Relative Distinguished Name (RDN) '%1' in the Exchange 5.5 directory contains one or more of %2 characters, please see Knowledge Base article <article number> before upgrading any servers to Exchange Server 2003. | (Same corrective action as above.)

ExDeploy.log

ExDeploy.log indicates whether OrgNameCheck ran successfully and lists any errors or warnings that appear in orgnamecheck.log. (For more information, see ExDeploy Log File.)


OrgPrepCheck Tool Group

OrgPrepCheck is a group of tools you can run after ForestPrep and DomainPrep, but before you deploy the initial server running Exchange Server 2003. This group of tools validates schema extensions, domains, and security descriptors. OrgPrepCheck runs the following tools:

  • OrgCheck
  • PolCheck


ExDeploy Command Options

You can run deployment tools in two ways:

  • Follow the process in this guide beginning with Welcome to the Exchange Server Deployment Tools. As you follow the steps, run the appropriate deployment tools by clicking the links provided. The links are pre-configured to run the ExDeploy command with the appropriate command options.
  • Run the ExDeploy command at the command prompt, either on a server or from the administrative console. Specify the tools you want to run in the ExDeploy command options.

If you prefer to run deployment tools by using the ExDeploy command, use the syntax and command options below.

ExDeploy Command Syntax

    ExDeploy [/s:[<5.5 server>:<port number>|?] [/gc:[<global catalog server>|?]] [/f:<ExDeploy.log file name>] [/c [/skip:<tool> [/skip:<tool>]]…] [/t:<tool> [/t:<tool>]…] [/p:<log file path>] [/h|/?]

Command Options

The following table describes the ExDeploy Command options.
/s:<5.5 server> or /s:<5.5 server>:<port number> or /s:? | Uses the specified Exchange 5.5 server as the destination server, or prompts for an Exchange 5.5 server name if ? is entered. This is a required option for some tools. Uses the :<port number> option to specify the LDAP port used by the Exchange 5.5 server. (Because Active Directory locks TCP port 389 for its own use, your Exchange 5.5 server may have been set up to use a different port. Usually, port 379 is recommended because it is not used by other Microsoft services; however, you should determine which port your server is using.)
/gc:<global catalog server> or /gc:? | Uses the specified global catalog server as the destination global catalog server. Entering ? prompts for a global catalog server name. This option is not required; if it is not specified, the deployment tool will search for a global catalog server.
/f:<log file name> | Redirects the ExDeploy.log output to the specified log file name.
/c | (Comprehensive) Runs all tools. This option can be used with /skip to skip specified tools.
/skip:<tool> [/skip:<tool>] | Skips all specified tools or tool groups (see List of Tools for syntax). Must be used with /c. Do not run in the same command line with /t.
/t:<tool> [/t:<tool>] | Runs all specified tools or group of tools (see List of Tools for syntax). Do not run in the same command line with /skip.
/p:<log file path> | Specifies the location of all deployment tool log files. By default, the Exchange Server Deployment Tools generate log files in the ExDeploy Logs directory; however, you can use the /p option to specify a different directory.
/h or /? or no options | Displays syntax help at the command prompt.


List of Log Files

Exchange Server Deployment Tools generate log files in the ExDeploy Logs directory or the directory you specify when you run the tools. The primary log file is the ExDeploy.log (Exchange Deployment Tools Log), which is updated with tool output and any errors each time you run a deployment tool. Many of the individual deployment tools generate additional log files that contain more detail.

The following table lists the log files generated by the deployment tools. Click a tool name for more information about the tool that generated the log, including the log contents, errors, and corrective action.

Log File Name | Generated By
ExDeploy.log | All deployment tools. See ExDeploy Log File.
adcconfigcheck.log | ADCConfigCheck Tool
adcobjectcheck.log | ADCObjectCheck Tool
adcusercheck.log | ADCUserCheck Tool
aduserscan.log | ADUserScan Tool
dsconfigsum.log | DSConfigSum Tool
e2kdsinteg.log | RecipientDSInteg Tool and ConfigDSInteg Tool
exdeploy-polcheck.log | PolCheck Tool
exdeploy-netdiag.log | NetDiag Tool
NtdsNoMatch.csv | NTDSNoMatch Tool
NtdsNoMatch.log | NTDSNoMatch Tool
orgnamecheck.log | OrgNameCheck Tool
<sitename>.csv | NTDSNoMatch Tool
usercount.log | UserCount Tool
vercheck.log | VerCheck Tool


Exchange Server Deployment Tools

List of Tools

The table below contains the complete list of Exchange Server Deployment Tools. The best way to run the deployment tools is to follow the processes outlined in this guide. The steps lead you through the deployment process and indicate where you should run the deployment tools. Wherever it is recommended in the process that you run a specific tool, you can click a pre-configured link to run the tool. Then follow the instructions provided for reviewing the log files and correcting any problems.

Note To simplify the deployment process, individual tools that can be run in the same step are combined into larger tool groups, as shown in the table below.

If you prefer to run the Exchange deployment tools at the command prompt instead of following the deployment process, you can use the ExDeploy command. You specify tool names or tool group names in in the /t and /skip command options (see ExDeploy Command Options).

Some of the deployment tools run automatically during Exchange Server Setup. When you run Exchange Server Setup, if you indicate that you are joining the new server to an existing Exchange 5.5 organization, Setup runs a subset of these tools. By running the tools in advance, you can correct any problems before you run Setup.

Exchange Server Deployment Tools

Click a tool name for a description.

Tool Group Name | Runs Tools:
DSScopeScan | DSConfigSum DsobjectSum UserCount VerCheck
OrgPrepCheck | OrgCheck PolCheck
SetupPrep | OrgCheck OrgNameCheck PubFoldCheck
(No tool group) | ADCConfigCheck
(No tool group) | ADCObjectCheck
(No tool group) | ADCUserCheck
(No tool group) | ADUserScan
(No tool group) | ConfigDSInteg
(No tool group) | PrivFoldCheck
(No tool group) | RecipientDSInteg


PolCheck Tool

PolCheck (Policy Check) checks that all domain controllers in the local domain have the Manage auditing and security logs permission for the Exchange Enterprise Servers group and reports any domain controllers that do not have this permission. It is highly recommended that you run PolCheck after you run ForestPrep and DomainPrep, but before deploying the initial server running Exchange Server 2003. Run PolCheck alone or as part of the OrgPrepCheck tool group.

Output

PolCheck sends output to the ExDeploy.log file and the exdeploy-polcheck.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). PolCheck does not run automatically during Exchange Server 2003 Setup.

Exdeploy-polcheck.log

The exdeploy-polcheck.log file lists names of domain controllers that do not have the Manage auditing and security logs permission. As you take steps to correct the problem (for example by running DomainPrep again or allowing replication to complete), you can run PolCheck again and use this log file to determine whether the problem is corrected on individual domain controllers.

ExDeploy.log

ExDeploy.log indicates whether PolCheck ran successfully and includes any errors or warnings. (For more information, see ExDeploy Log File.)


Exchange 5.5 Coexistence Prerequisites

Your existing organization may consist of servers running Exchange 5.5 on Microsoft Windows NT 4.0, with one or more separate Windows domains. Or, your organization may consist of Exchange 5.5 servers running on Windows 2000 Server. In either case, before you begin the upgrade process, make sure your existing organization meets the following requirements:

  • Each site in your existing organization contains at least one server running Exchange 5.5 SP3 to allow synchronization between the Exchange 5.5 directory and Active Directory.
  • You have established NetBIOS, RPC, and TCP/IP connectivity between the Exchange 5.5 (Windows NT 4.0) environment and Windows domain controller(s).
  • You have network access to a Windows global catalog server that is no more than one Active Directory site away.
  • You have backed up your Exchange 5.5 servers and Windows servers.
  • (Recommended) The domain in which you plan to install the first server running Exchange Server 2003 is in Windows native mode so that you can use universal groups (see The Importance of a Windows Native Mode Domain). Universal groups allow distribution lists and public folder permissions to migrate correctly. Universal groups also allow Outlook users to see the membership of distribution lists that span multiple domains.


Operating System and Active Directory Requirements

Before you install or upgrade to Exchange Server 2003, ensure that your existing organization meets the following requirements.

File Format Requirements

To install Exchange Server 2003, disk partitions must be formatted for NTFS, not FAT. This requirement applies to the following:

  • System partition
  • Partition that stores Exchange binaries
  • Partitions containing transaction log files
  • Partitions containing database files
  • Partitions containing other Exchange files

Operating System Requirements

Exchange Server 2003 is supported on the following operating systems:

  • Windows 2000 Service Pack 3 (SP3) or later
  • Windows Server 2003

Windows 2000 Server

If you intend to install Exchange Server 2003 on a server running Windows 2000, you must download and install Windows 2000 SP3 or the latest service pack. Otherwise, the Exchange Server 2003 Setup program will stop the installation. Windows 2000 service packs are available on the Windows Service Packs Web page. Windows 2000 SP3 (or later) is also a prerequisite for running the Exchange Server 2003 Active Directory Connector.

Windows Server 2003

If you intend to run Exchange Server 2003 on a computer running Windows Server 2003, you must install the latest release and service pack of Windows Server 2003. Ensure that the following services are installed and enabled:

  • .NET Framework
  • ASP.NET and the latest device updates

Upgrading Windows 2000 Server to Windows Server 2003

If you intend to upgrade servers running Windows 2000 Server to servers running Windows Server 2003, you must install Exchange Server 2003 on the servers before you upgrade the operating systems. After you upgrade a server to Exchange Server 2003 on Windows 2000 SP3 or later, you can further upgrade the server to Windows Server 2003. By following this upgrade sequence, you take advantage of the logic built into Exchange Server 2003 to handle the underlying operating system upgrade. Specifically, Exchange Server 2003:

  • Ensures that the World Wide Web Service is not disabled as part of the upgrade (this normally occurs with Windows 2000 Server to Windows Server 2003 upgrades.
  • Switches Internet Information Server 6.0 to Worker Process Isolation (dedicated) mode.
  • Enables Exchange Internet Server Application Programming Interfaces (ISAPIs) in Internet Information Server.

You do not need to reinstall Exchange Server 2003 on the server after the operating system upgrade.

Active Directory

The Exchange Server 2003 Setup program must be able to contact at least one Active Directory server running Windows 2000 SP3 or later or Windows Server 2003 within the local Active Directory site. Domain controllers and global catalog servers must be running Windows 2000 SP3 or later or Windows Server 2003 for Exchange Server 2003 to recognize them.


PrivFoldCheck Tool

PrivFoldCheck (Private Folder DS/IS Check) uses the Exchange 5.5 Directory Service/Information Store (DS/IS) consistency adjuster to ensure that the directory and the information store are synchronized. Inconsistencies between the directory and the information store occur when there is an entry for a mailbox in the directory database without a corresponding entry in the information store, or vice versa.

PrivFoldCheck runs the DS/IS consistency adjuster with the following options:

  • Synchronize with the directory and create new directory entries for mailboxes that do not have a corresponding directory entry PrivFoldCheck creates an entry in the directory if a mailbox entry exists in the information store, but not in the directory. PrivFoldCheck does not delete mailbox entries from the directory.
  • Remove unknown user accounts PrivFoldCheck removes users that are no longer valid from private information store folder permissions.

It is highly recommended that you run PrivFoldCheck before you move mailboxes from servers running Exchange 5.5 to Exchange Server 2003 mailbox stores. PrivFoldCheck is a stand-alone tool and is not contained in any of the tool groups. To run PrivFoldCheck, your account must have Exchange 5.5 Administrator permissions (with rights to view objects in the Exchange directory).

Caution Never run the DS/IS consistency adjuster after deleting a directory replication connector to another site unless you never plan to reconnect the sites. Do not run the DS/IS consistency adjuster after joining a site unless directory replication within the site has completed.

Output

PrivFoldCheck sends output to the ExDeploy.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). PrivFoldCheck does not run automatically during Exchange Server 2003 Setup.

For detailed information on PrivFoldCheck errors, warnings, and corrective action that appear in ExDeploy.log, see ExDeploy Log File.


Enabling Windows Services

Exchange Server 2003 Setup requires that the following services be installed and enabled on the server:

  • .NET Framework
  • ASP.NET
  • World Wide Web service
  • SMTP service
  • NNTP service

If you are installing Exchange Server 2003 on a server running Windows 2000, Exchange Setup automatically installs and enables Microsoft .NET Framework and ASP.NET. You must enable the W3SVC, SMTP, and NNTP services before running Exchange Server 2003 Installation Wizard.

If you are installing Exchange Server 2003 in a native Windows Server 2003 forest or domain, none of these services is enabled by default. You must enable the services before running Exchange Server 2003 Installation Wizard.

Important When you install Exchange on a new server, only the required services are enabled. However, if you upgrade an existing server, Setup will not disable services that are already enabled. Therefore, you should review the status of all services after the upgrade. In general, unless there is a reason to run a particular service, you should disable it. For example, if you do not use POP3, IMAP4, or NNTP, you should disable these services on all Exchange servers.

To enable services in Windows 2000

  1. On the Start menu, point to Settings, and then click Control Panel.
  2. Double-click Add/Remove Programs.
  3. Click Add/Remove Windows Components.
  4. Click Internet Information Services (IIS) and then click Details.
  5. Select the check boxes for NNTP Service, SMTP Service, and World Wide Web Server.
  6. Click OK.
  7. Ensure that the Internet Information Services (IIS) check box is selected.

To enable services in Windows Server 2003

  1. On the Start menu, click Control Panel.
  2. Double-click Add or Remove Programs.
  3. Click Add/Remove Windows Components.
  4. Click Application Server, and then click Details.
  5. Select the check box for ASP.NET.
  6. Click Internet Information Services (IIS) and then click Details.
  7. In Internet Information Services (IIS), select the check boxes for NNTP Service, SMTP Service, and World Wide Web Service, and then click OK.
  8. In Application Server component selection, ensure that the Internet Information Services (IIS) check box is selected, and then click OK to install the components that you selected.

    Note Do not select the E-mail Services check box.

  9. Click Next.
  10. Enable ASP.NET by performing the following steps:
    1. On the Start menu, click Control Panel.
    2. Double-click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.
    3. Double click the local computer.
    4. Double-click Web Service Extensions.
    5. In the details pane, click ASP.NET <version> and then click Allow.


Installing SMTP and NNTP

Simple Mail Transfer Protocol (SMTP) and Network News Transfer Protocol (NNTP) are Windows services that must be installed on the server on which you plan to run Exchange Server 2003. Exchange Server 2003 uses the SMTP service for message transfer and the NNTP service to enable access to Internet standard newsgroups.

To verify that SMTP and NNTP are installed:

  1. Click Start, point to Settings, click Control Panel, and then double-click Add/Remove Programs.
  2. Click Add/Remove Windows Components.
  3. Click Internet Information Services (IIS), and then click Details.
  4. Make sure the boxes for SMTP and NNTP are checked, click OK, and then click Next.

    Note You need access to the Windows 2000 Server, Windows 2000 Advanced Server, or Windows Server 2003 source files through an Intranet connection or the product installation disc.

  5. After the installation process finishes, close the Windows Components Wizard.


PubFoldCheck Tool

PubFoldCheck (Public Folder DS/IS Check) uses the Exchange 5.5 Directory Service/Information Store (DS/IS) consistency adjuster to ensure that the directory and the information store are synchronized. Inconsistencies between the directory and the information store occur when there is an entry for a public folder in the directory database without a corresponding entry in the information store, or vice versa.

PubFoldCheck runs the DS/IS consistency adjuster with the following options:

  • Synchronize with the directory and reset the home server value for pubic folders homed in unknown sites PubFoldCheck creates an entry in the directory if a public folder entry exists in the information store. PubFoldCheck deletes entries from the directory for any public folder entries that do not exist in the information store. If the home servers of any public folders are in an unknown site, PubFoldCheck resets the home server to the server on which you run PubFoldCheck.
  • Remove unknown user accounts from public folder permissions PubFoldCheck removes users that are no longer valid from public folder permissions.
  • Inconsistencies more than 1 day PubFoldercheck performs the above actions for only inconsistencies that are older than one day.

Caution Never run the DS/IS consistency adjuster after deleting a directory replication connector to another site unless you never plan to reconnect the sites. Do not run the DS/IS consistency adjuster after joining a site unless directory replication within the site has completed.

Output

PubFoldCheck sends output to the ExDeploy.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). PubFoldCheck also runs automatically during Exchange Server 2003 Setup and sends output to the Exchange Server Setup Progress log at the root of the drive where you installed Exchange. The log indicates whether PubFoldCheck ran successfully and includes any errors or warnings.

For detailed information on PubFoldCheck errors, warnings, and corrective action that appear in ExDeploy.log, see ExDeploy Log File.


RecipientDSInteg Tool

The RecipientDSInteg tool runs checks on each recipient object (User, Group, Contact, or Public Folder) in Active Directory. These checks are designed to detect problems in Active Directory after Active Directory Connector has been running.

To run RecipientDSInteg, your account must have Domain Administrator permissions (with rights to view objects in Active Directory).

Output

RecipientDSInteg sends output to the ExDeploy.log file and the e2kdsinteg.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). The ExDeploy.log file indicates whether RecipientDSInteg ran successfully. The e2kdsinteg.log file lists any warnings resulting from the recipient object checks. These warnings are listed below. RecipientDSInteg does not run automatically during Exchange Server 2003 Setup.

RecipientDSInteg Warnings

The following warnings may appear in the e2kdsinteg.log file.

  • User is both mail enabled and mailbox enabled
  • User is mailbox enabled and contains no home mailbox database
  • User is mailbox enabled and contains no home message transfer agent
  • User is mailbox enabled and contains no home server name
  • User is mailbox enabled and contains no mailbox GUID (globally unique identifier)
  • User is mailbox enabled and does not contain an account control
  • User contains no Exchange 5.5 distinguished name
  • User contains no proxy addresses
  • User contains no primary SMTP address
  • User contains no primary X.400 address
  • User is not hidden and does not belong to an address list
  • Disabled User is mailbox enabled and does not contain an associated external account
  • (For a user object) Keyword "ntdsnomatch" could not be found within any extension attribute
  • User contains an ambiguous Exchange 5.5 distinguished name
  • User contains an ambiguous mailbox GUID
  • User contains an ambiguous master account SID
  • Group contains no Exchange 5.5 distinguished name
  • Group contains no proxy addresses
  • Group contains no primary SMTP address
  • Group contains no primary X.400 address
  • Group is not hidden and does not belong to an address list
  • Group contains an ambiguous Exchange 5.5 distinguished name
  • Contact contains no Exchange 5.5 distinguished name
  • Contact contains no proxy addresses
  • Contact contains no primary SMTP address
  • Contact contains no primary X.400 address
  • Contact is not hidden and does not belong to an address list
  • Contact does not contain a target address
  • Contact contains an ambiguous Exchange 5.5 distinguished name
  • Public folder contains no Exchange 5.5 distinguished name
  • Public folder contains no proxy addresses
  • Public folder contains no primary SMTP address
  • Public folder contains no primary X.400 address
  • (Public Folder) Contact is not hidden and does not belong to an address list
  • Public folder does not contain a target address
  • Public folder contains no home mailbox database
  • Public folder contains an ambiguous Exchange 5.5 distinguished name
  • Object is of unknown type


Reference Documentation

The following sections provide links to the documents listed in the "Reference" column within each process, as well as to deployment tool and log file descriptions.

Deployment Tool Descriptions

  • List of Tools
  • ExDeploy Command Options

Deployment Tool Logs

  • List of Log Files

References for Coexistence with Exchange 5.5

  • Exchange 5.5 Coexistence Prerequisites
  • The Importance of a Windows Native Mode Domain
  • Operating System and Active Directory Requirements
  • Where to Install New Server Hardware
  • Enabling Windows Services
  • DSScopeScan Tool Group
  • DCDiag Tool
  • NetDiag Tool
  • ExDeploy Log File
  • ForestPrep
  • DomainPrep
  • OrgPrepCheck Tool Group
  • SetupPrep Tool Group
  • VerCheck Tool
  • Configuring Connection Agreements to Use the New Server
  • Tools for Validating Exchange 5.5 and Exchange 2003 Coexistence
  • ADCConfigCheck Tool
  • ConfigDSInteg Tool
  • RecipientDSInteg Tool
  • PrivFoldCheck Tool

References for Coexistence with Mixed Mode Exchange 2000 and Exchange 5.5 Reference

  • Exchange 5.5 Coexistence Prerequisites
  • The Importance of a Windows Native Mode Domain
  • ForestPrep
  • DomainPrep
  • ExDeploy Log File
  • Operating System and Active Directory Requirements
  • Enabling Windows Services
  • DCDiag Tool
  • NetDiag Tool

References for Upgrade from Exchange 2000 Native Mode

  • Operating System and Active Directory Requirements
  • Enabling Windows Services
  • DCDiag Tool
  • NetDiag Tool
  • ForestPrep
  • DomainPrep

References for New Exchange 2003 Installation

  • Operating System and Active Directory Requirements
  • Enabling Windows Services
  • DCDiag Tool
  • NetDiag Tool
  • ForestPrep
  • DomainPrep

References for Installing Exchange 2003 on Additional Servers

  • Operating System and Active Directory Requirements
  • Enabling Windows Services
  • DCDiag Tool
  • NetDiag Tool
  • DomainPrep

References for Post-Installation Steps

  • Move Mailboxes
  • Move System Folders and Public Folders
  • Configure Internet E-Mail Delivery


SetupPrep Tool Group

SetupPrep is a group of tools you can run before installing Exchange Server 2003 to check for Exchange 5.5 organization and site names that contain special characters, to validate schema extensions, domains, and security descriptors, and to ensure that the Exchange 5.5 directory and information store are synchronized. SetupPrep runs the following tests:

  • OrgNameCheck
  • OrgCheck
  • PubFoldCheck

Note SetupPrep is not a command option. If you want to run ExDeploy from a command prompt, you cannot cannot use SetupPrep; however, you can run the OrgNameCheck, OrgCheck, and PubFoldCheck tools individually.


UserCount Tool

UserCount is an optional tool run during the planning stage to scope the deployment. It reports the total number of users in each Exchange 5.5 site and the total number of users in the Exchange 5.5 directory.

Note If you run UserCount in an Exchange organization that contains servers running Exchange 5.5 and Exchange Server 2003, the output does not differentiate between Exchange 5.5 users and Exchange Server 2003 users.

Run UserCount alone or as part of the DSScopeScan tool group. To run UserCount, your account must have Exchange 5.5 Administrator permissions (with rights to view objects in the Exchange directory).

Output

UserCount sends output to the ExDeploy.log file and the usercount.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). UserCount does not run automatically during Exchange Server 2003 Setup.

The log files list the following UserCount information:

  • Number of users in each site
  • Total number of users in the Exchange 5.5 directory

ExDeploy.log also indicates whether UserCount ran successfully and includes any errors or warnings. (For more information, see ExDeploy Log File.)


UserPrep Tool Group

UserPrep is a group of tools you can run before installing the Active Directory Connector to preview the results of matching user accounts to mailboxes, get a list of recommended connection agreements, ensure that your servers will support an upgrade, and verify that server names do not contain special characters. UserPrep runs the following tests:

  • ADCUserCheck
  • NTDSNoMatch
  • VerCheck
  • OrgNameCheck

To run UserPrep, your account must have Domain Administrator permissions (with rights to write to Active Directory) and Exchange 5.5 administrator permissions (with rights to view objects in the Exchange directory).


VerCheck Tool

VerCheck (Server Version Check) determines whether the organization contains the server versions required for upgrade to Exchange Server 2003. At least one server running Exchange 5.5 with Service Pack 3 (SP3) or later must be present in the organization or Exchange Server 2003 Setup will fail. It is highly recommended that you run VerCheck and take any necessary corrective action before you install Active Directory Connector. Run this tool alone or as part of the DSScopeScan and UserPrep tool groups.

To run VerCheck, your account must have Exchange 5.5 Administrator permissions (with rights to view objects in the Exchange directory).

Output

VerCheck sends output to the ExDeploy.log file and the vercheck.log file in the ExDeploy Logs directory (or the directory you specified when you ran the tools). VerCheck also runs automatically during Exchange Server 2003 Setup and sends output to the Exchange Server Setup Progress log at the root of the drive where you installed Exchange. The log indicates whether VerCheck ran successfully and includes any errors or warnings.

Vercheck.log

The vercheck.log file lists the following information for each server in the organization:

  • Server name
  • Exchange version
The vercheck.log file also lists the following errors or warnings if they occur.

Error or Warning Message | Corrective Action
Warning: Site '%1' cannot be converted to Exchange Server 2003 or later until a server is upgraded to Exchange 5.5 SP3 or later. | Each site in your existing organization must contain at least one server running Exchange 5.5 SP3 or later to allow synchronization between the Exchange 5.5 directory and Active Directory. Upgrade at least one server in the site to Exchange Server 5.5 SP3 or later. To facilitate deployment, the server you upgrade should host the Exchange 5.5 mailboxes and should be located in the same Exchange 5.5 site as the new server that will host the Exchange Server 2003 mailboxes.

ExDeploy.log

ExDeploy.log indicates whether VerCheck ran successfully and includes any errors or warnings that appear in Vercheck.log. (For more information, see ExDeploy Log File.)


Where to Install New Server Hardware

Use the following guidelines to determine where to connect the new server:

  • If the Exchange 5.5 server you plan to use for directory synchronization is located in a Windows NT 4.0 domain, set the new server's domain membership to an Active Directory domain that has a direct two-way trust with the NT 4.0 domain. (Trusts between Windows NT 4.0 domains and Active Directory domains are not transitive.)
  • If the Exchange 5.5 server is located in one of many Active Directory domains that make up a forest, you can set the new server's domain membership to the same domain as the Exchange 5.5 server. In contrast with cross-domain setups, this setup may reduce the number of permissions changes required for Exchange 2003 installation.
  • If possible, connect the new server to the same network segment as a server running Exchange 5.5 SP3 or later.
  • It is recommended that the Windows domain be in native mode. See The Importance of a Windows Native Mode Domain.