Copyright: Microsoft Exchange Server Help  (c) 1999 Microsoft Corporation
Citation: (c) 1999 Microsoft Corporation


General (Default ADC Policy)

A Default ADC Policy is the collective set of default attributes that  Connection Agreements replicate.  A policy applies to all Connection Agreements.


From Exchange (Default ADC Policy)

Use this tab to specify the attributes that will make up a Policy for Connection Agreements.  These attributes are replicated by default from the Exchange Directory to the Windows Active Directory.

  Attributes


From Windows (Default ADC Policy)

Use this tab to specify the attributes that will make up a Policy for Connection Agreements. These attributes are replicated by default from Windows to Exchange.

  Attributes


Attributes

Specify the attributes to be replicated from the objects currently selected in the Objects box on the From Windows and From Exchange tabs.


General (Active Directory Connector)

This tab displays the name of the Active Directory Connector home server.

  Home Server


Home Server

The name of the server where  Active Directory Connector is installed.


Diagnostic Logging
Diagnostic Logging (Active Directory Connector)

Use this tab to select logging levels and logging categories for Active Directory Connector (ADC). Each logging category provides informational, warning, and error messages.

Diagnostic logging levels determine which ADC events are written to the Windows application event log. Events can range from significant (such as a failure to initialize ADC), to moderately important (such as confirmation of the number of objects to be replicated), to those relevant only to debugging. Normally, you log only significant events. However, when problems occur, diagnostic logging enables you to change the logging levels to capture more detailed events.

  Category

  Category Logging Levels


Category

A group of related application functions. Logging levels are set by category.

The following table describes each of the categories.

Category	Description of Messages
Replication	Events that occurred during replication.
Account management	Events that occurred while creating or deleting Windows accounts.
Attribute mapping	Events that occurred while mapping attributes between the Windows Active Directory and the Exchange directory.
Service Controller	Events that occurred when the service is started or stopped.
LDAP Operations	Events that occurred while accessing the directory using LDAP.


Category logging levels

Displays the logging level for the category.

The logging level determines which events are written to the Windows application event log. When an event occurs with a severity less than or equal to the logging level, the event is automatically logged.

Level	Description
None (default level)	Only critical events, or error events are logged. This includes information such as whether Active Directory Connector started or stopped successfully, error messages that indicate the service failed to start, or error messages that indicate required components are not installed.
Minimum	Includes information about success or failure to add or remove user accounts from the directory and specific errors encountered when establishing an LDAP session or when updating the directory.
Medium	Includes information about whether specific objects exist or do not exist in the directory and warnings about proxy errors.
Maximum	Includes detailed information about the status of the replication.


General (Connection Agreement)

Use this tab to specify the name of the Connection Agreement you are creating, the type of directory replication the Connection Agreement will provide, and to select an Active Directory Connector service to host the Connection Agreement.

  Name

  Replication direction

  Active Directory Connector service


Name

The name of the Connection Agreement that you are creating. This name cannot be changed once the Connection Agreement has been created.


Replication direction

Select one of the following replication directions.

Direction	Description
Two-way	During a two-way replication, the Windows Active Directory is first updated with Exchange directory information.  Then the Exchange information is replicated to Windows.
From Exchange to Windows	Updates the Windows Active Directory.
From Windows to Exchange	Updates the Exchange directory.
Note  In a two-way replication, the Exchange and Windows authentication type and credentials (specified on the Connections tab) must be able to write to and read from both the Exchange directory and the Windows Active Directory. In a one-way replication, the authentication type and credentials must have read access to the export directory (from) and write access to the import directory (to).

When creating a new user in Active Directory Users and Computers, you have the option to add an Exchange mailbox for the user only if a Two-way or From Windows to Exchange Connection Agreement is configured.


Active Directory Connector service

Select a server that has ADC installed. If the service you are looking for does not appear on the list it means that it is not compatible with the Connection Agreement you are creating or editing. Only compatible available services are shown.


Connections (Connection Agreement)

Use this tab to provide information required to establish a connection between the Windows Active Directory server and the Exchange directory server. For each server connection, specify the server name, type of security authentication, and a user account with write permissions to the server's directory.

The syntax used to identify the Connect as user account for Windows varies depending on the type of Authentication you select.  However, for Exchange the domain name is required regardless of the authentication type.

  Server

  Authentication

  Connect as

  Modify

  Port Number


Server

The name of the server to connect to.


Authentication

The type of security authentication to use when connecting to the server.

Type	Description
Basic (Clear Text) using SSL	Enable authentication using clear text through a channel encrypted with Secure Sockets Layer (SSL). Legacy Connection Agreements must use this type of authentication.
Windows Challenge/Response (default setting)	Enable authentication using Windows network security.
Windows Challenge/Response using SSL	Enable authentication using Windows network security through an SSL-encrypted channel.


Connect as

The user account name to be used when making the connection.

The user account must have permissions to write to the directory on the server you are connecting to. Use the Modify button to designate a user account. Legacy Connection Agreements must use Basic (Clear Text) with SSL authentication.


Modify

Select to change the Connect as user account name and password.

The user account must have permissions to write to the directory on the server you are connecting to.


Port Number

Specify the Lightweight Directory Access Protocol (LDAP) port number currently being used by the Exchange directory to which this Connection Agreement will connect. By default, the Exchange directory uses port number 389. Verify that there isn't a port number conflict with Windows 2000.

Note  To verify the port number currently being used by the Exchange directory, use the Exchange Server Administrator program. In the <organization name>\<site name>\Configuration\Servers\<server name>\Protocols container, on the General tab of the LDAP (Directory) Settings object, check the Port number setting.


Connect As

Use this dialog box to specify the user account name and password for establishing a connection to the server. The user account must have permissions to write to the directory on the server you are connecting to.

The syntax used to identify the Connect as user account varies depending on the type of Authentication you select.  However for Exchange the domain name is required regardless of the authentication type.

Windows Challenge/Response

When connecting to either the Windows server or the Exchange server, the Connect as user account is specified in the form:
<Windows domain name>\<account name>
for example: Redmond\gladysl

  Connect as

  Browse

  Password


Connect as

Specify the user account name for establishing a connection to the server.

The user account must have permissions to write to the directory on the server you are connecting to.


Browse

Opens the Select User dialog box that allows you to select from the list of user accounts in your organization.


Password

Type a password for authenticating the user account.


Schedule (Connection Agreement)

Use this tab to specify when and how often this Connection Agreement replicates to all containers specified on the From Exchange or From Windows tabs. The schedule grid consists of rows representing days and columns representing 1-hour blocks or 15-minute blocks depending on the detail view you select.

  Never

  Always

  Selected times

  Detail view

  Schedule grid

  Replicate the entire directory the next time the agreement is run


Never

Prevents the Connection Agreement from performing directory replication except if you select Replicate Now . Use to temporarily stop the Connection Agreement in order to perform system maintenance.


Always

Sets the directory replication to occur continuously.


Selected times

Sets the directory replication to occur at specific times or blocks of time designated in the schedule grid.


Detail view

Select 1 Hour to view the schedule grid in one-hour increments, or select 15 Minute to view the schedule grid in 15-minute increments.


Replicate the entire directory the next time the agreement is run

Select this check box to replicate the entire directory. Clear the check box to only replicate changes in your directory information. By default, the entire directory is replicated the first time you run the Connection Agreement.


From Exchange (Connection Agreement)

Use this tab to specify the Exchange directory objects and their specific attributes you want to replicate. Select which Exchange directory containers to replicate from and which Windows Active Directory folder to replicate to.

Two replication cycles may be required before all information, such as attributes, will appear on the Exchange tabs of a replicated Windows object.

Note  You must supply all the information on the Connections tab before you can connect to your Exchange server and choose Exchange Recipients containers from which the updates will be taken, or before you can connect to your Windows server and choose a Windows Active Directory folder as the destination.

  Exchange Recipients containers

  Add

  Remove

  Default destination

  Modify

  Objects


Exchange Recipients containers

The Exchange Recipients containers from which directory objects will be replicated.


Add

Use to add Exchange Recipients containers from which directory objects will be replicated.


Remove

Removes the selected container from the list of Exchange Recipients containers.


Default destination

The Windows Active Directory object where new Windows Active Directory objects will be created that correspond to Exchange directory objects which are being replicated for the first time. Exchange directory objects that correspond to Windows Active Directory objects in other locations will continue to replicate to the Windows Active Directory objects that already exist, even if they are located somewhere other than the default destination.


Modify

Select to browse the Windows Active Directory and select a directory object as the default destination of the replicated Exchange directory objects.


Objects

Displays the types of objects to be replicated.

The type of the check mark indicates the type of replication that will occur for that object.

Check Mark Type	Description
Black	The object is replicated with all of its attributes specified on the policy.
None	No attributes are selected for this object. The object will not be replicated.


From Windows (Connection Agreement)

Use this tab to specify the Windows Active Directory objects and their specific attributes you want to replicate. Select which Windows Active Directory folders to replicate from and which Exchange directory container to replicate to.

Two replication cycles may be required before attributes, will appear on the Exchange tabs of a replicated Windows object.

Note  You must supply all the information on the Connections tab before you can connect to your Windows server and choose Windows Active Directory folders from which the updates will be taken, or before you can connect to your Exchange server and choose an Exchange Recipients container as the destination.

  Windows organizational units

  Add

  Remove

  Default destination

  Modify

  Objects

  Replicate secured Active Directory objects to the Exchange Directory


Windows organizational units

The list of the Windows Active Directory containers from which selected objects will be replicated.


Add

Use to browse the Windows Active Directory and select containers from which to replicate directory objects.


Remove

Removes the selected container from the list of Windows Active Directory containers.


Default destination

The Exchange Recipients container that is the destination for the replicated Windows Active Directory objects.


Modify

Use to select the Exchange Recipients container to which Windows Active Directory objects will be replicated.


Replicate secured Active Directory objects to the Exchange Directory

Select this check box to filter the objects that are replicated from Windows to Exchange based on the Access Control Lists set on those objects.


Deletion (Connection Agreement)

Use this tab to specify which method Active Directory Connector uses to replicate the deletion of directory objects. You can select a different method for each direction of the replication.

For example, you can specify that when Exchange mailboxes are deleted, the corresponding Windows user accounts are also deleted, or that the names of the objects are written to a log file, and the target objects are preserved.

  When replicating deletions from the Windows Active Directory

  When replicating deletions from the Exchange Directory


When replicating deletions from the Windows Active Directory

Select the method to use when replicating the deletion of Windows user accounts.

•	Delete the Exchange mailboxes, custom recipients and distribution lists

Select to delete in the Exchange directory any user account that was deleted in the Windows Active Directory.

•	Keep the Exchange deleted items and store the deletion list in the temporary CSV file

The list of deleted objects is in a comma-separated values (CSV) log file. Information is appended to this file as replication occurs.

The log file is located in %SystemRoot%\MSADC\<Connection Agreement name>\ex55.csv

You can review the deletions list by opening the log file in a spreadsheet application. You can update the Exchange directory with the deletions recorded in the log file by using the Bulk Import command in the Exchange Administrator program.

Note  Active Directory Connector does not perform any checking or maintenance of the deletions list, so the file will continue to grow in size as entries are appended to it.  The user is responsible for ensuring that sufficient disk space is available and for removing the file when it is no longer needed in order to recover the disk space occupied by the file.


When replicating deletions from the Exchange Directory

Select the method to use when replicating the deletion of Exchange mailboxes.

•	Delete the Windows users, contacts and groups

Select to delete in the Windows Active Directory any mailbox that was deleted in the Exchange directory.

•	Keep the Windows deleted items and store the deletion list in the temporary LDF file

Select to remove any mail attributes.on each object in the Windows Active Directory whose corresponding mailbox was deleted in the Exchange directory. The list of deleted objects is then stored in an LDF file. Information is appended to this file as replication occurs.

The log file is located in %SystemRoot%\MSADC\<Connection Agreement name>\win2000.ldf.

You can review the deletions list by opening the log file in a word processing application.

Note  Active Directory Connector does not perform any checking or maintenance of the deletions list, so the file will continue to grow in size as entries are appended to it.  The user is responsible for ensuring that sufficient disk space is available and for removing the file when it is no longer needed in order to recover the disk space occupied by the file.


Advanced (Connection Agreement)

Use this tab to set paging options for the replication service, specify whether it is a Primary Connection Agreement, and how to handle replicating to a Windows account that doesn't exist in the domain.

  Paged results

  This is a primary Connection Agreement for the connected Exchange organization

  This is a primary Connection Agreement for the connected Windows Domain

  When replicating a Mailbox whose Primary Windows Account does not exist in the domain


Paged results

Paging improves performance by grouping objects to be replicated before each request for replication service. Larger page sizes (more entries per page) result in fewer requests but require more memory. The default value is 20 entries per page.

If this Connection Agreement is configured to replicate from Windows to Exchange, Exchange Server entries per page is unavailable. If this Connection Agreement is configured to replicate from Exchange to Windows, Windows Server entries per page is unavailable.

The page size for Exchange should not exceed the LDAP search results on the server.  Setting the paging size to zero will prevent replication from occuring.


This is a primary Connection Agreement for the connected Exchange organization

The check box indicates whether this Connection Agreement is a Primary Connection Agreement or a non-primary Connection Agreement with Exchange. The check box is selected by default.

Clear the check box to designate this Connection Agreement as a non-primary Connection Agreement. A non-primary Connection Agreement does not create any new objects in Exchange. It only replicates attributes between Exchange mailbox objects and their corresponding Windows user objects. The replication is only established where the Windows user account is designated as the Primary Windows account on the General tab of the Exchange mailbox. If the Windows user account does not already have a corresponding object in the destination directory, the non-primary Connection Agreement will not create one.

A Connection Agreement does not have to be a Primary Connection Agreement for replication to occur.

The type of object created depends on the type of object being replicated and whether that object is mail-enabled.

When replicating Windows Active Directory objects to the Exchange  directory:

	Windows object replicated	Exchange object created
Mail-enabled	user	custom recipient
	contact	custom recipient
	group	distribution list
Mailbox-enabled	user	mailbox
When replicating Exchange directory objects to the Windows Active Directory:

Exchange object replicated	Windows object created
mailbox	user
custom recipient	contact or user
distribution list	group
Important

If you are using more than one Connection Agreement to replicate Windows user accounts to a single Exchange organization, it is important that only one of the Connection Agreements is designated as a Primary Connection Agreement. Multiple primary Connection Agreements replicating to the same Exchange organization will result in duplicate recipient objects in the Exchange organization. Consequently, the This is a primary Connection Agreement for the connected Exchange organization check box is selected by default only in the first Connection Agreement created. If you create Connection Agreements to more than one Exchange organization, be sure to manually select the check box in only one Connection Agreement for each Exchange organization.


This is a primary Connection Agreement for the connected Windows Domain

The check box indicates whether this Connection Agreement is a Primary Connection Agreement or a non-primary Connection Agreement for the Windows Domain. The check box is selected by default.

Clear the check box to designate this Connection Agreement as a non-primary Connection Agreement. A non-primary Connection Agreement does not create any new objects in Windows 2000. It only replicates attributes between Windows user objects and their corresponding Exchange mailbox. If the Windows user account does not already have a corresponding object in the destination directory, the non-primary Connection Agreement will not create one.

A Connection Agreement does not have to be a Primary Connection Agreement for replication to occur.

The type of object created depends on the type of object being replicated and whether that object is mail-enabled.

When replicating Windows Active Directory objects to the Exchange  directory:

	Windows object replicated	Exchange object created
Mail-enabled	user	custom recipient
	contact	custom recipient
	group	distribution list
Mailbox-enabled	user	mailbox
When replicating Exchange directory objects to the Windows Active Directory:

Exchange object replicated	Windows object created
mailbox	user
custom recipient	contact or user
distribution list	group
Important

If you are using more than one Connection Agreement to replicate Windows user accounts to a single Exchange organization, it is important that only one of the Connection Agreements is designated as a Primary Connection Agreement. Multiple primary Connection Agreements replicating to the same Exchange organization will result in duplicate recipient objects in the Exchange organization. Consequently, the This is a primary Connection Agreement for the connected Windows Domain check box is selected by default only in the first Connection Agreement created. If you create Connection Agreements to more than one Exchange organization, be sure to manually select the check box in only one Connection Agreement for each Exchange organization.


Mail-Enabled and Mailbox-Enabled Objects

Windows Active Directory objects can be mail-enabled or mailbox-enabled.

Mail-enabled

A mail-enabled object has an e-mail address associated with it but no Exchange mailbox, and thus can receive e-mail from Exchange users but would have to connect to a third party application to send e-mail.

•	In Windows Active Directory Users and Computers, right-click a user, contact, or group. On the shortcut menu, select Enable Exchange Mail.

Mailbox-enabled

A mailbox-enabled object has an Exchange mailbox associated with it, and thus can both send and receive e-mail. Only Windows user accounts can be mailbox-enabled.

In Windows Active Directory Users and Computers, a Windows user account can become mailbox-enabled by doing the following:

•	Right-click a user, and on the shortcut menu, click Add Exchange Mailbox.  Type an Alias, select a server, then click OK.

A Windows user account can also become mailbox-enabled if it is designated as the Primary Windows account on the General tab of an Exchange mailbox. The user account will be mailbox-enabled after the next replication cycle.


When replicating a Mailbox whose Primary Windows Account does not exist in the domain

Select how to handle replicating a mailbox that doesn't have a Primary Windows Account in the domain:

•	Create a Windows Contact

A pointer to a foreign address or a recipient outside the  organization.

•	Create a Disabled Windows User Account

A user account that does not permit logons.

•	Create a New Windows User

A record that consists of all the information that defines a user to Windows 2000.  It creates a new user account in the Windows 2000 directory which includes membership groups, and the rights and permissions for the user.