Preparing Your Network for ADC Deployment

Only one instance of the ADC service can be active on a single computer running Windows 2000 Server. However, the ADC can support multiple connection agreements. To prepare for deployment of ADC, consider the requirements and recommendations described in the following section.

Considering Specific Network Requirements

There are two network-specific tasks that you should consider as you gather information for your ADC Connection Agreement Plan. These tasks are as follows:

Select servers to be bridgehead servers.

Bridgehead servers receive and forward e-mail traffic at each end of a connection agreement, similar to the task a gateway performs. When you select servers to be ADC bridgehead servers, they should meet the following conditions:

• Have adequate resources (CPU and memory) to support synchronization traffic and processing of incoming LDAP sessions.
• Be well connected to the network. For example, if an Exchange Server site spans multiple physical locations across a hub-and-spoke network, its bridgehead server for the Exchange Server site should be located at the hub.
• If the ADC bridgehead server is not a global catalog server, it should be on the same local area network (LAN) segment as a global catalog server. The reason for this is that ADC attempts to contact a global catalog in order to perform target matching searches. When ADC picks up a new object from Exchange Server, the ADC does not want to accidentally create a corresponding Active Directory object in one domain. By searching in the global catalog, the ADC minimizes the chance that it will create a duplicate object.
• If the Exchange Server environment employs connector servers that do not host mailboxes, consider configuring these servers as ADC bridgehead servers.

Identify resource usage.

Both the synchronization of directory objects between directories and the replication that occurs within the Active Directory and Exchange Server directory replication environments consume network resources.

Once Active Directory becomes relatively static after the upgrade from Windows NT Server 4.0 to Windows 2000 Server and the synchronization with Exchange Server, only small amounts of data will pass between Active Directory and the Exchange Server 5.5 directory service. Changes to the Exchange Server 5.5 directory that are synchronized to the Active Directory cause slightly more traffic than changes to Active Directory that are synchronized to Exchange Server.

Computer Requirements

When preparing to use ADC, observe these technical computer requirements:

• You must have at least one Windows 2000 Server.
• You must have at least one Exchange Server 5.5 with SP1 (at a minimum) installed on each Exchange Server defined in a connection agreement.

Depending on the synchronization schedule, the ADC server and other directory servers with which it interacts could face a significant processing load. It is important that these computers are appropriately specified (CPU and memory) and well-connected to the network — ideally they should be on the same LAN. Unlike directory replication schedules in the Exchange Server 5.x environment, if the schedule is set to Always in the user interface, the ADC attempts to synchronize changes between Active Directory and the Exchange Server directory. This synchronization takes place in cycles of maximum continuous replication time and synchronization sleep delay of five minutes.

The expected resource usage for Pentium-class servers (200 MHz) with 128Mb of memory and one connection agreement configured is shown in Table 20.1.

Table 20.1 Pentium-class Server CPU Utilization

To compare the differences between types and speeds of CPUs, see the resource usage of Dual Pentium II-class servers (450Mhz) with 256Mb of memory shown in Table 20.2.

Table 20.2 Dual Pentium II-class Server CPU Utilization

For enterprise-size Exchange Server 5.5 and Active Directory deployments, you will need to carefully plan for any additional overhead that the ADC and its connection agreements produce. This is particularly important to those who need to accurately size servers and network capacity. This is even more important when the ADC server, domain controller, and Exchange Server 5.5 are connected over relatively slow links.

Deployment Recommendations

Consider the following recommendations to promote a successful deployment:

Populate Active Directory with user accounts by upgrading the primary domain controller (PDC) to Microsoft Windows 2000 Server.    Use ADC to backfill directory data from the Exchange Server directory to the pre-existing Active Directory accounts. This permits objects synchronized from Exchange Server to be mapped to security objects in Active Directory.

Use Directory Replication Bridgehead servers to facilitate Exchange Server directory replication between Exchange Server sites.    Where it is possible, use them as ADC bridgehead servers for connection agreements.

Place the server hosting ADC on the same subnet as the Exchange Server directory and Active Directory bridgeheads, if possible.    If you are using ADC in a wide area network (WAN) environment, place it in a strategic location, such as at the hub of a hub-and-spoke topology.

Synchronize the entire Exchange Server site instead of synchronizing individual recipient containers.    It is possible to choose the entire Exchange Server site as the source and target on the Exchange Server, and also to choose the Active Directory domain as the source and target on the Active Directory side. This will effectively synchronize the recipient container hierarchy in Exchange Server with the OU hierarchy in Windows 2000 Server. You can choose to change the OU hierarchy or the location of individual recipients created in the Active Directory by the ADC at a later time. By moving recipients or OUs to a new location, the next time the ADC synchronizes, it finds the new locations and synchronizes with the existing recipients — if it is within the search scope of defined import and export containers.

For the best performance, install ADC on a member server in the Windows 2000 Server domain.    Depending on the synchronization schedule, if you configure the ADC with multiple connection agreements, it could consume a good deal of processor time. If you intend to install the ADC on a domain controller or global catalog, ensure that the server hardware accommodates the extra processing load.

Either create ADC connection agreements between a global catalog and Exchange Server or deploy the ADC in close network proximity to a global catalog.    In a multi-domain environment, the ADC performs searches against the global catalog, even if there is no connection agreement for synchronizing with a global catalog server. The purpose for searching in the global catalog is to ensure that the ADC does not create duplicate objects in the forest.

ADC Implementation Strategy

In order to successfully install the ADC and configure a connection agreement, you must be able to log on to Windows 2000 Server with an account that carries distinctive credentials. Permissions required to perform various tasks are as follows:

Initial ADC Installation

When you first install ADC in a Windows 2000 forest, the ADC Setup program extends the Active Directory schema with the Exchange schema extensions. In order to do this, the account that you are running Setup from must belong to a member of the Schema Administrators group or otherwise have permissions to extend the schema.

Additionally, ADC Setup creates objects in the Active directory configuration container. This requires that the account you are running Setup from belongs to a member of the Domain Administrators group or otherwise has permissions to create objects in the Services and Sites containers.

Finally, ADC Setup creates two security groups in the local domain—one is "Exchange Services" and the other is "Exchange Administrators." This requires that the account you are running Setup from belongs to a member of the Domain Administrators Group or otherwise has permissions to create objects in the Users container.

Subsequent Installations of the ADC

Subsequent installations of the ADC in the same forest do not require Schema Administrator permissions. Subsequent installations do require either Domain Administrator permissions or other specific permissions that allow you to create new objects under the Sites and Services containers in the configuration naming context. Additional installations in the same domain do not require the creation of either the Exchange Services or the Exchange Administrators groups. However, the first ADC installation into any other Windows 2000 Server domain requires the creation of these groups and subsequently the proper permissions to do so.

ADC Configuration

You can configure the ADC policy by viewing the property pages of the top-level node in the ADC Administrator MMC snap-in. By modifying the policy, you can control the set of attributes synchronized from either directory as well as the set of rules used by the ADC to match objects in either directory.

ADC Schema and Object Mapping

Each connection agreement uses a table-based schema map for the majority of attributes on objects synchronized between the two directories. The default map is located on the ADC policy object in Active Directory. While it is possible to enable and disable a subset of attributes synchronizing in either direction, it is not possible to modify the schema mapping from the ADC Administrator MMC snap-in.

Tables 20.3, 20.4, 20.5, and 20.6 list many of the mappings defined in the default schema map.

Table 20.3 defines the attribute mappings for all objects in Windows 2000 and Exchange. If an attribute value for an attribute to be mapped does not exist in the source directory, that mapping is ignored.

Table 20.3 Attribute Mappings for All Objects

Table 20.4 defines the attribute mappings for all User objects and Mailbox objects in Windows 2000 and Exchange.

Table 20.4 Object Class-Specific Mappings

Table 20.5 defines the attribute mappings for Contact objects and Custom objects in Windows 2000 and Exchange.

Table 20.5 Object Class-Specific Mappings

Table 20.6 defines the attribute mappings for Group objects and Distribution List objects in Windows 2000 and Exchange.

Table 20.6 Object Class-Specific Mappings

Base your determination of the number of connection agreements your organization requires on your unique network environment, including your deployment objectives and requirements and your expectations for the outcome of implementation. You must also familiarize yourself with the Exchange Server and Active Directory object attributes that you are not able to synchronize. These attributes are listed in Table 20.7.

Table 20.7 Attributes of Objects That Do Not Synchronize

© 1985-2000 Microsoft Corporation. All rights reserved.