In this part of the posting, we will prepare the Active Directory environment for Exchange 2013. Before you begin, make sure to read the posting in the previous section in order to take note of Exchange 2013 prerequisites.

Domain Considerations:
– If you are going to install Exchange Server 2013 on in a Forest that hosts multiple domains, Microsoft recommends that you perform the preparation steps in a Active Directory Site that hosts all of the domains. This will greatly facilitate replication across Domain boundaries. In several production sites that I’ve worked in, we deployed a number of virtualized child domain controllers in a physical hub network site to facilitate replication.

Installation Steps:

1. Extend the Active Directory Schema
The schema is an essential part of Active Directory, as it ensures that attributes for each class of objects in the forest are standardized and consistent, to prevent replication errors from happening. Before you can install Exchange 2013, you need to update the schema so that existing object classes (such as users) can now have email-enabled attributes and new object classes specific to Microsoft Exchange can be created.

To perform this task, you will need to:
– Log into a DC that has the schema master FSMO role†, with an Administrative account that has both Enterprise Admin and Schema Admin privileges.

• †You can locate the Schema Master role by connecting to a Domain Controller and using the dcdiag /test:knowsofroleholders /v command. The identity of the schema master is listed as:
• Role Schema Owner = CN=NTDS Settings,CN=XYZDC01, CN=Servers,CN=Default First-Site-Name,CN=Sites,CN=Configuration,DC=CorpXYZ,DC=com

There are a number of alternative ways to obtain the identity of the Schema Master and other FSMO role holders, check out this Knowledge Base article for more information.

– After logging in, ensure that you download the Microsoft Exchange Server installation file locally to the DC and extract the contents into a local folder.

– I’ve also fired up ADSI edit in order to review the Schema changes.

– From a command line prompt, navigate to the directory that you extracted the installation files to and type in the following command:

setup /IAcceptExchangeServerLicenseTerms /Prepareschema

This command will connect to the Schema Master and update the schema with Exchange 2013 Specific Attributes.

You can see this in action by viewing the Schema Partition in ADSI Edit and looking for attributes with the following prefix “CN=ms-Exch”. You can track the progress of the schema updates via ms-Exch-Schema-Version-Pt, which is a pointer that increments as each schema update is made. When the RangeUpper value gets to 15137, you will know that all of the schema updates have run smoothly.

Eightwone.com has a great posting on the schema versions corresponding to the different builds of Microsoft Exchange here.

Okay, now that we’ve completed updating our Schema, it might take a bit of time for replication to complete. There are a number of ways to verify that the Exchange 2013 schema updates have successfully replicated across the domain. One simple way is to check your replication event logs on destination DCs. Another way is to use the Repadm command line tool. Within the same domain, I like to use the command:

 Get-ADReplicationUpToDatenessVectorTable :domaincontrollername

You can validate replication consistency by comparing the UsnFilter attributes of the various domain controllers in the domain.

2. Prepare Active Directory for Exchange
The Active Directory Configuration Partition contains information about specific services (like Microsoft Exchange or Certificate Services) that Active Directory is aware of. We need to prepare the Active Directory Configuration partition to support Exchange 2013 servers by running the command:

     setup /IAcceptExchangeServerLicenseTerms/PrepareAD
     /OrganizationName:CHIMPCORP

The OrganizationName refers to the Instance name of your Microsoft Exchange Server installation. Note that you can only have one OrganizationName value per Active Directory Forest, so if you have an existing Exchange implementation in your AD forest, you would specify the OrganizationName of that implementation here.

In order to perform this task, you need to log on to a Domain Controller in the same domain as the Schema Master, and with Enterprise Admin group credentials. (As you will be making modifications to the Configuration partition of Active Directory which get replicated throughout the forest).

The PrepareAD process performs the following actions:

• Creates the Microsoft Exchange Services container under  CN=Services,CN=Configuration,DC=<root domain>.
• Creates the Exchange organization container with the OrganizationName parameter that you specify above, under CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<root domain >
• Validates the schema has been updated in CN=<your organization>,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<domain> container to 15449.
• Sets the msExchProductId of the Exchange organization object in the CN=<your organization>,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<domain> container to 15.00.0516.032.
• Creates the following containers which are required for Exchange Server 2013 to function in the Configuration Partition of Active Directory: Address Lists Container, AddressBook Mailbox Policies, Addressing, Administrative Groups, Auth Configuration, Client Access, Connections, ELC Folders Container, ELC Mailbox Policies, ExchangeAssistanceGlobal Settings, Hybrid Configuration, Mobile Mailbox Policies, Monitoring Settings, OWA Mailbox Policies, Provisioning Policy Container, RBAC, Recipient Policies, Remote Accounts Policies Container, Retention Policies Container, Retention Policy Tag Container, ServiceEndpoints, System Policies, Team Mailbox Provisioning Policies, Transport Settings, UM AutoAttendant, UM DialPlan, UM IPGateway, UM Mailbox Policies, Workload Management Settings.
• Assigns extended rights for Exchange to install into Active Directory and creates the “Microsoft Exchange Security Groups” OU for each domain that you run this command in.
• Creates a number of Management Role Groups into the “Microsoft Exchange Security Groups” OU and adds them to the otherWellKnownObjects attribute stored on the CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=<root domain>.
• Creates the Unified Messaging Voice Originator contact in the Microsoft Exchange System Objects container of the root domain.
• Prepares the local domain for Exchange 2013. For information about what tasks are completed to prepare a domain, see Step 3.

You can view the updates to the Configuration Partition by firing up ADSIEdit.msc and connecting to the Configuration Partition. (Rightclick > ADSI Edit > Select Connect to > Select a well known Naming Context > Configuration).

Note that the configuration partition of Active Directory is consistent throughout the entire Forest, so note that any changes you make may take time to replicate throughout the forest too.

3. Prepare Active Directory Domains
We now need to prepare the individual Active Directory domains that will be hosting Exchange 2013 servers by running the command:

     setup /PrepareDomain:<FQDN of Domain>
     OR
     setup /PrepareAllDomains

The former command prepares a single domain and requires Domain Admin credentials for the specified domain; while the latter command prepares all domains in your forest and requires Enterprise Admin credentials.

Either variant of the PrepareDomain command performs the following tasks:

• Creates the Microsoft Exchange System Objects container in the root domain partition in Active Directory and sets permissions on this container for the Exchange Servers, Exchange Organization Administrators, and Authenticated Users groups. This container is used to store public folder proxy objects and Exchange-related system objects, such as the mailbox database’s mailbox.
• Sets the objectVersion property in the Microsoft Exchange System Objects container under DC=<root domain>. This objectVersion property contains the version of domain preparation. The version for Exchange 2013 is 13236.
• Creates a domain global group in the current domain called Exchange Install Domain Servers. The command places this group in the Microsoft Exchange System Objects container. It also adds the Exchange Install Domain Servers group to the Exchange Servers USG in the root domain.
• Assigns permissions at the domain level for the Exchange Servers USG and the Organization Management USG.

Run the command from a command prompt and at completion you should see the following:

To verify that this command successfully worked, you should be able to verify the following:

• A new global group in the Microsoft Exchange System Objects container called Exchange Install Domain Servers. (Don’t forget to click Advanced Features in the View menu in Active Directory User and computers first.)
  
• The Exchange Install Domain Servers group is a member of the Exchange Servers USG in the root domain.
  
• The Exchange Servers USG has permissions on the Domain Controller Security PolicyLocal PoliciesUser Rights AssignmentManage Auditing and Security Log policy.
  

So to summarize, we performed the following tasks so far:

1. Performed /setup PrepareSchema on the Schema Master DC to extend the AD Schema
2. Performed /setup PrepareAD to prepare the Configuration Partition
3. Performed /setup PrepareDomain to create specific Security Groups and assign permissions to these groups

As you can see, the preparation steps are fairly straightforward and also similar to installation steps for older versons of Microsoft Exchange. In the next post, we will install Exchange 2013.

Road Chimp, over and out.