Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or...

31
Contents Confirm prerequisites for Exchange 2010 are met .......................................................................... 3 Configure disjoint namespace ......................................................................................................... 4 Install the Client Access server role ................................................................................................ 6 Add digital certificates on the Client Access server ....................................................................... 10 Enable Exchange 2010 Outlook Anywhere ................................................................................... 15 Configure OAB and Web Services virtual directories .................................................................... 16 Configure virtual directory properties............................................................................................. 17 Install the Hub Transport server role ............................................................................................. 18 Configure a legacy host name ....................................................................................................... 21 Install the Mailbox server role ........................................................................................................ 23 Move OAB generation to Exchange 2010 ..................................................................................... 26 Move Exchange 2007 mailboxes to Exchange 2010 .................................................................... 27 Post-installation tasks .................................................................................................................... 29 Checklist complete......................................................................................................................... 31

Transcript of Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or...

Page 1: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

Contents

Confirm prerequisites for Exchange 2010 are met .......................................................................... 3

Configure disjoint namespace ......................................................................................................... 4

Install the Client Access server role ................................................................................................ 6

Add digital certificates on the Client Access server ....................................................................... 10

Enable Exchange 2010 Outlook Anywhere ................................................................................... 15

Configure OAB and Web Services virtual directories .................................................................... 16

Configure virtual directory properties............................................................................................. 17

Install the Hub Transport server role ............................................................................................. 18

Configure a legacy host name ....................................................................................................... 21

Install the Mailbox server role ........................................................................................................ 23

Move OAB generation to Exchange 2010 ..................................................................................... 26

Move Exchange 2007 mailboxes to Exchange 2010 .................................................................... 27

Post-installation tasks .................................................................................................................... 29

Checklist complete......................................................................................................................... 31

Page 2: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise
Page 3: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

3

Confirm prerequisites for Exchange 2010 are met

Before you go any further with the Exchange Deployment Assistant, make sure that your

organization's operating system, hardware, software, clients, and other elements meet the

requirements for Exchange 2010. If they don't, you won't be able to complete the steps in the

Deployment Assistant and you won't be able to deploy Exchange 2010.

Learn more at: Understanding Exchange 2007 Upgrade Prerequisites

To successfully install Exchange 2010, the following components are required.

Directory Servers Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service

Pack 1 (SP1) Standard or Enterprise operating system or later, or the latest 32-bit or 64-bit

edition of the Windows Server 2008 Standard or Enterprise operating system or later.

Global catalog server In every Active Directory site where you plan to install Exchange

2010, you must have at least one global catalog server that is either the latest 32-bit or 64-bit

edition of Windows Server 2003 SP2 Standard or Enterprise, the latest 32-bit or 64-bit edition

of Windows Server 2008 Standard or Enterprise, or the latest 32-bit or 64-bit edition of

Windows Server 2008 R2 Standard or Enterprise.

Active Directory Forest The Active Directory forest must be Windows Server 2003 forest

functional mode.

Domain Controller You must have the latest 32-bit or 64-bit Windows Server 2003 SP1 or

later Standard Edition or Enterprise edition operating system or the latest 32-bit or 64-bit

edition of the Windows Server 2008 Standard or Enterprise RTM or later operating system or

the Windows Server 2008 R2 Standard or Enterprise RTM or later operating system.

Operating Systems 64-bit edition of Windows Server 2008 Standard Service Pack 2

64-bit edition of Windows Server 2008 Enterprise Service Pack 2

64-bit edition of Windows Server 2008 Standard R2

64-bit edition of Windows Server 2008 Enterprise R2

Operating System Components .NET Framework 3.5 SP1

Internet Information Services (IIS)

Page 4: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

4

Windows Management Framework Windows PowerShell V2.0

Windows Remote Management V2.0

Exchange 2007 Environment Exchange Server 2007 Service Pack 3 Before you can deploy Exchange 2010 into an

existing Exchange 2007 environment, each Exchange 2007 server must be running

Exchange 2007 Service Pack 3 (SP3) or later. Exchange 2007 SP3 is required for Exchange

2010 and Exchange 2007 coexistence.

Configure disjoint namespace

Estimated time to complete: 20 minutes

By default, the primary Domain Name System (DNS) suffix portion of a computer's fully qualified

domain name (FQDN) is the same as the name of the Active Directory domain where the

computer is located. When the primary DNS suffix portion of a computer's FQDN is different from

the Active Directory domain where the computer is located, this is known as a disjoint

namespace.

To run Exchange 2010 in a disjoint namespace, there are two tasks you must perform:

Configure the DNS suffix search list.

Create a list of allowed suffixes by modifying the value for the msDS-AllowedDNSSuffixes

attribute of the domain object container. For more information about the msDS-

AllowedDNSSuffixes attribute, download this topic from the Windows Server Help and

Support Center: Domain Rename Procedure

How do I configure the DNS suffix search list? You'll use the Group Policy Management Console (GPMC) to get this task done. If you're running

Windows Server 2008, GPMC is installed by default. If you're running Exchange 2003, you can

download GPMC from: Group Policy Management Console with Service Pack 1

1. Open the GPMC on a Windows directory server in your domain by clicking Start > Programs

> Administrative Tools > Group Policy Management.

2. In Group Policy Management, expand the forest and the domain in which you will apply

Group Policy. Right-click Group Policy Objects, and then click New.

3. In New GPO, type a name for the policy, and then click OK.

4. Right-click the new policy that you created in Step 3, and then click Edit.

5. In Group Policy Object Editor (Group Policy Management Editor in Windows Server

2008) expand Computer Configuration, (expand Policies in Windows Server 2008),

expand Administrative Templates, expand Network, and then click DNS Client.

Page 5: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

5

6. Right-click DNS Suffix Search List, and then click Properties.

7. On the DNS Suffix Search List Properties page, select Enabled. In the DNS Suffixes box,

type the primary DNS suffix of the disjoint computer, the DNS domain name, and any

additional namespaces for other servers with which Exchange may interoperate, such as

monitoring servers or servers for third-party applications. Click OK.

8. In Group Policy Management, expand Group Policy Objects, and then select the policy

that you created in Step 3. On the Scope tab, in the Security Filtering area, click Add to

scope the policy so that it applies to only the computers that are disjoint.

Learn more about Group Policy at: Windows Server Group Policy

How do I modify the msDS-AllowedDNSSuffixes attribute? To do this procedure, you'll need to use an Active Directory editor such as Active Directory

Service Interfaces (ADSI) Edit or the LDP (Ldp.exe) tool.

Learn more at: XADM: Using the LDP Utility to Modify Active Directory Object Attributes

Caution:

Be careful! If you incorrectly modify the attributes of Active Directory objects, you may

cause serious problems that may require that you reinstall Windows Server.

1. Use the procedure above to ensure that the Change primary DNS suffix when domain

membership changes check box is clear.

2. Modify the msDS-AllowedDNSSuffixes Active Directory attribute on the domain object

container. You can do this with ADSI Edit:

a. Double-click the domain directory partition for the domain you want to modify.

b. Right-click the domain container object, and then click Properties.

c. On the Attribute Editor tab, in the Attributes box, double-click msDS-

AllowedDNSSuffixes.

d. In the Multi-valued String Editor dialog box, in the Value to add box, type a DNS suffix,

and then click Add.

e. When you have added all the DNS suffixes for the domain, click OK.

f. Click OK to close the Properties dialog box for that domain.

Repeat these steps if you have multiple domains you want to similarly configure.

How do I know this worked? To check that you have configured the DNS settings correctly, ping each server from each other

server using both server short names and server FQDNs. In addition, check the System event log

on each server and verify there are no events that indicate problems related to name resolution,

directory lookups, or group policy.

Page 6: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

6

Install the Client Access server role

Estimated time to complete: 45 minutes

The Client Access role is one of five server roles in Exchange 2010. It's also the first server role

that must be installed. The Client Access role enables access to mailbox data through a variety of

clients, such as Microsoft Office Outlook, Outlook Anywhere, Outlook Web App, POP3, and

IMAP4, and it also hosts Exchange Web services, such as the Autodiscover service and the

Availability service.

Learn more at: Understanding the Client Access Server Role

Although you can deploy each server role on a single server, we recommend that you deploy

multi-role servers in certain scenarios.

Learn more at: Understanding Single and Multi-Role Server Installations

We recommend installing the latest update rollup for Exchange 2010 on all your servers.

Although you can install update rollups on a server after Exchange 2010 has been installed, it's

also possible and less time-consuming to incorporate the update rollup into the install server

installation process. To do this, copy the contents of the Exchange 2010 DVD to the file system,

and then copy or move the downloaded update rollup file to the Updates folder in the installation

tree. When you perform the procedure below, the update rollup will be installed as part of the

initial installation process.

To download the latest update rollup for Exchange 2010, visit: Microsoft Download Center

Important:

When you upgrade your organization to the RTM version of Exchange 2010, your clients

running Outlook 2003 don’t use RPC encryption, and RPC Client Access requires it by

default. This can cause connection issues between Exchange 2010 and Outlook 2003. In

Exchange 2010 SP2, RPC Client Access doesn't require RPC encryption by default. If

you have Outlook 2003 clients within your organization, we recommend that you install

Exchange 2010 SP2 to avoid connection issues between Exchange 2010 RTM and

Outlook 2003. For more information, see Understanding RPC Client Access.

How do I do this? You'll use the Exchange Server 2010 Setup wizard to install the Client Access role.

Important:

When you install the first Exchange 2010 server role, Exchange 2010 prepares your

Windows schema and forest before installing the server role. The amount of time that

forest preparation and replication takes depends on your Active Directory site topology.

1. Insert the Exchange 2010 DVD into the DVD drive. When the AutoPlay dialog appears, click

Run Setup.exe under Install or run program. If the AutoPlay dialog doesn't appear,

navigate to the root of the DVD and double-click Setup.exe. Alternatively, browse to the

location of your Exchange 2010 installation files and double-click Setup.exe.

Page 7: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

7

2. The Exchange Server 2010 Setup welcome screen appears. In the Install section, the

software listed for Step 1: Install .NET Framework 3.5 SP1 and Step 2: Install Windows

PowerShell v2 was installed with the Exchange 2010 prerequisites. If these prerequisites

aren't already installed, click the appropriate step to install them.

3. When Step1, Step2, and Step3 are listed as Installed, click Step 4: Install Microsoft

Exchange.

Note:

After your installation is complete, you can return to complete Step 5: Get critical

updates for Microsoft Exchange.

4. On the Introduction page, click Next.

5. On the License Agreement page, review the software license terms. If you agree to the

terms, select I accept the terms in the license agreement, and click Next.

6. On the Error Reporting page, select Yes or No to enable the Exchange Error Reporting

feature, and click Next.

7. On the Installation Type page, select Custom Exchange Server Installation. For

Exchange 2010 SP2, you can select to automatically install all required Windows roles and

features for this server. If you want to change the installation path for Exchange 2010, click

Browse, locate the appropriate folder in the folder tree, and then click OK. Click Next.

8. On the Server Role Selection page, select the Client Access Role, (or other server roles

you want to install) and click Next. The Management Tools option, which installs the

Exchange Management Console and the Exchange Management Shell, will also be selected

and installed.

Page 8: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

8

9. Use the Configure Client Access Serverexternal domain page to configure an external

fully qualified domain name (FQDN). This is the FQDN that you give to Outlook Web App,

Outlook Anywhere, and Exchange ActiveSync users to connect to Exchange 2010. Select the

check box, enter your FQDN, and then click Next.

10. On the Customer Experience Improvement Program page, optionally join in the Exchange

Customer Experience Improvement Program (CEIP). The CEIP collects anonymous

information about how you use Exchange 2010 and any problems that you encounter. To join

the CEIP, select Join the Customer Experience Improvement Program, choose the

industry that best represents your organization, and then click Next.

11. On the Readiness Checks page, review the Summary to determine if the system and server

are ready for the Client Access role to be installed. If all prerequisite checks completed

successfully, click Install. If any of the prerequisite checks failed, you must resolve the

displayed error before you can proceed with installing Exchange. In many cases, you don't

need to exit Setup while you're fixing issues. After you resolve an error, click Retry to run the

prerequisite check again. Also, be sure to review any warnings that are reported.

Page 9: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

9

12. The Progress page displays the progress and elapsed time for each phase of the

installation. As each phase ends, it's marked completed and the next phase proceeds. If any

errors are encountered, the phase will end as incomplete and unsuccessful. If that happens,

you must exit Setup, resolve any errors, and then restart Setup.

13. When all phases have finished, the Completion page displays. Review the results, and verify

that each phase completed successfully. Clear the check box for Finalize this installation

using the Exchange Management Console, and then click Finish to exit Setup.

14. When you're returned to the Setup welcome screen, click Close. On the Confirm Exit prompt,

click Yes.

15. Restart the computer to complete the installation of the Client Access role.

Create a Client Access Server Array

If you're installing multiple Client Access servers in one Active Directory site, you can create a

Client Access server array. This is a load-balanced group of Client Access server computers that

can be accessed through a single URL. Creating a Client Access array reduces the number of

fully qualified domain names (FQDN) you need to have on your certificate, and it allows all users

in one Active Directory site to access Exchange 2010 through a single URL.

After you've completed the installation of your first Client Access server computer, you can start

creating your Client Access server array.

To create a new Client Access server array, run the following command using the Exchange

Management Shell.

New-ClientAccessArray -FQDN ClientArray.contoso.com -Site "YourSite" -

Name "clientarray.contoso.com"

There can only be one Client Access array per Active Directory site. After you've created the

array, you can manage which Client Access server computers are part of the array through your

load balancer configuration.

If you're unfamiliar with the Shell, learn more at: Overview of Exchange Management Shell

How do I know this worked? The successful completion of the Exchange Setup wizard will be your first indication that the

installation process worked as expected. To further verify that the Client Access server

role installed successfully, you can run Get-ExchangeServer <server name> | Format-

List in the Exchange Management Shell, which you can start from the Exchange Server 2010

program group on the Windows Start Menu. This cmdlet outputs a list of the Exchange 2010

server roles that are installed on the specified server.

You can also check the Exchange setup log (ExchangeSetup.log), located in

<system drive>\ExchangeSetupLogs to verify that the Client Access role was installed as

expected.

Learn more at: Verify an Exchange 2010 Installation

Page 10: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

10

Add digital certificates on the Client Access server

Estimated time to complete: 30 minutes

For secure external access to Exchange, you'll need a digital certificate. This certificate will

include an exportable private key in X.509 format (DER encoded binary or Base-64 encoded). We

recommend you procure, import, and enable a Subject Alternative Name (SAN) certificate that

contains the names for the current namespace, a legacy namespace, and the Autodiscover

namespace.

The names you need to include in your Exchange certificate are the fully qualified domain names

(FQDNs) used by client applications to connect to Exchange. For example, a company named

Contoso that uses contoso.com can use just three hostnames for all client connectivity within an

Active Directory site:

mail.contoso.com This name can cover nearly all client connections to Exchange,

including Microsoft Office Outlook, Outlook Anywhere, offline address book (OAB) downloads

(by Outlook), Exchange Web Services (for Outlook 2007 and later, and Entourage 2008),

POP3, IMAP4, SMTP (both client and other SMTP server connections), Outlook Web App,

the Exchange Control Panel, Exchange ActiveSync, and Unified Messaging.

autodiscover.contoso.com This name is used for Autodiscover, which is used by Outlook

2007 and later, Outlook Anywhere, Exchange ActiveSync, Exchange Web Services clients,

and Windows Mobile 6.1 and later.

legacy.contoso.com This name is used to maintain Internet access to an older version of

Exchange while you transition to Exchange 2010. This is necessary during transition because

some Exchange services (for example, Outlook Web App, Exchange ActiveSync, and

services that send configuration information through Autodiscover) tell clients to connect

directly with the old Exchange servers if they see requests to access a mailbox on an older

version of Exchange.

In addition to these three names, your root domain (for example, contoso.com) will also be added

as a name.

There are three steps to adding certificates to your Client Access server(s):

1. If you don't already have a digital certificate, you can use the New Certificate Request Wizard

in Exchange 2010 to generate a certificate request file, which you can then submit to your

selected Certification Authority.

2. After you have the digital certificate from your Certification Authority, you then complete the

certificate request process by importing the certificate into your Client Access server.

3. After the certificate has been imported, you assign one or more client access services to it.

Before proceeding with these steps, we recommend that you review this topic: Understanding

Digital Certificates and SSL

In addition, the configuration settings used in the Exchange Deployment Assistant assumes that

you’re using split DNS for client access. Learn more at: Understanding DNS Requirements

Page 11: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

11

Finally, if your Exchange 2003 server isn’t currently configured to use SSL for client access, you’ll

need to enable SSL to secure the communications between the client messaging applications

and the Exchange front-end server. You’ll also need to install the SSL certificate on the Exchange

2003 front-end server. Learn more at: Exchange Server 2003 Client Access Guide

How do I create a certificate request file for a new certificate? You can use the New Exchange Certificate wizard to create your certificate request.

1. In the Console tree, click Server Configuration.

2. From the Actions pane, click New Exchange Certificate to open the New Exchange

Certificate wizard.

3. On the Introduction page, enter a friendly name for the certificate (for example,

Contoso.com Exchange certificate) and then click Next.

4. On the Domain Scope page, if you plan on using a wildcard certificate, check the box for

Enable wildcard certificate, enter the root portion of your domain (for example contoso.com

or *.contoso.com), and then click Next. If you're not using a wildcard certificate, just click

Next.

Note:

It's a best practice to not use wildcard certificates because they represent a potential

security risk. Like a SAN certificate, a wildcard certificate (for example,

*.contoso.com) can support multiple names. There are security implications to

consider because the certificate can be used for any sub-domain, including those

outside the control of the actual domain owner. A more secure alternative is to list

each of the required domains as Subject Alternative Names in the certificate. By

default, this approach is used when certificate requests are generated by Exchange.

5. On the Exchange Configuration page, expand and configure each area as follows:

a. Federated Sharing Federated Sharing allows you to enable users to share information

with recipients in external federated organizations by creating organization relationships

between two Exchange 2010 organizations, or using a sharing policy to allow users to

create sharing relationships on an individual basis. If you plan on using this feature,

expand Federated Sharing and select the Public certificate check box.

b. Client Access server (Outlook Web App) Expand this option and select the check

box(es) that are appropriate for your Outlook Web App usage (Intranet and/or Internet). If

you're using Outlook Web App internally, then in the Domain name you use to access

Outlook Web App internally field, remove the existing server names and enter the

FQDN you configured for external access to the Client Access server during Setup of the

Client Access server (for example, mail.contoso.com). This is the same FQDN that is

listed in the domain name field for Outlook Web App on the Internet.

Page 12: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

12

c. Client Access server (Exchange ActiveSync) Exchange ActiveSync should already

be selected and the domain name field should be configured with the same FQDN used

for Outlook Web App.

d. Client Access server (Web Services, Outlook Anywhere, and

Autodiscover) Exchange Web Services, Outlook Anywhere, and Autodiscover on the

Internet should already be selected. Outlook Anywhere should already be configured to

use two FQDNs: one that is the same FQDN used by Outlook Web App (for example,

mail.contoso.com) and one that is the root domain for that FQDN (for example,

contoso.com). Autodiscover should already be configured to use a long URL, which

should automatically be configured as autodiscover.rootdomain (for example,

autodiscover.contoso.com).

e. Client Access server (POP/IMAP) If you plan on using secure POP or secure IMAP

internally or over the Internet, expand this option and select the appropriate check box. In

the domain name field for each protocol, remove the individual server names and enter

the same FQDN you're using for Outlook Web App.

f. Unified Messaging server If you plan on using Unified Messaging (UM) features, you

can use a certificate that is self-signed by an Exchange 2010 UM server (which is the

default option). If you're integrating UM with Office Communications Server (OCS), you'll

need to use a public certificate. We recommend using a separate certificate for UM and

OCS integration.

g. Hub Transport server Hub Transport servers can use certificates to secure Internet

mail, as well as POP and IMAP client submission. If you plan on using mutual TLS or if

you're using POP or IMAP clients and want to secure their SMTP submissions, select the

appropriate check box and in the FQDN field, enter the same FQDN you're using for

Outlook Web App.

h. Legacy Exchange Server This option is used to add the legacy namespace to the

certificate, which will be used only during the period of coexistence between Exchange

2010 and the legacy version(s). Expand this option, select the Use legacy domains

check box, and in the FQDN field, enter the FQDN you are using for your legacy

namespace.

6. On the Certificate Domains page, review the list of domains that will be added to the

certificate. If the names are correct, click Next. If any names are missing or incorrect, you can

click Add to add missing names, or select a name and click Edit to modify the name. Click

Next.

7. On the Organization and Location page, fill in the Organization, Organization unit,

Location, Country/region, City/locality, and State/province fields. Click Browse and

browse to the location where you want the certificate request file created. In the File name

field, enter a name for the request file (for example, Exchange Certificate Request.req) and

click Save. Click Next.

8. On the Certificate Configuration page, review the configuration summary. If any changes

need to be made, click Back, and make the necessary changes. If everything is correct, click

New to generate the certificate request file.

Page 13: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

13

9. On the Completion page, review the output of the wizard. Click Finish to close the wizard.

10. Transmit the certificate request file to your selected Certification Authority, who will then

generate the certificate and transmit it to you. After you have the certificate file, you can use

the Complete Pending Request wizard to import the certificate file into Exchange 2010.

11. In the Console tree, click Server Configuration.

12. In the Work pane, right-click the certificate request you created and click Complete Pending

Request.

13. On the Introduction page, click Browse to select the certificate file provided to you by your

selected Certification Authority. Enter the private key password for the certificate, and then

click Complete.

14. On the Completion page, verify that the request completed successfully. Click Finish to

close the Complete Pending Request wizard.

How do I assign services to the certificate? You can use the Assign Services to Certificate wizard to assign the appropriate services to the

imported certificate.

1. After the certificate has been successfully imported, you can assign services to it. Select the

certificate in the Work pane, and then from the Actions pane, click Assign Services to

Certificate to open the Assign Services to Certificate wizard.

2. On the Select Servers page, the Exchange server into which you imported the certificate is

shown. Click Next.

3. On the Select Services page, select the check box for each service you want assigned to

the selected certificate and then click Next. For example, select the check box for Internet

Information Services (IIS) to assign services for Outlook Web App, Exchange ActiveSync,

and other Exchange services that are integrated with IIS.

4. On the Assign Services page, review the configuration summary. If any changes need to be

made, click Back. If the configuration summary is correct, click Assign to assign the

specified services to the selected certificate.

5. On the Completion page, verify that each step completed successfully. Click Finish to close

the wizard.

How do I install the certificate on the legacy Exchange server? In addition to installing the SSL certificate on the Exchange 2010 Client Access server, you'll also

need to install the certificate on the Exchange 2007 Client Access server or the Exchange 2003

server so that users with mailboxes on Exchange 2007 or Exchange 2003 can use SSL to

connect to their mailboxes.

Page 14: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

14

Note:

If you'll be moving all mailboxes from Exchange 2003 or Exchange 2007 to Exchange

2010 over a short period of downtime, such as a weekend, you can skip these steps.

Before you install the digital certificate on the legacy Exchange server you must first export it from

the Exchange 2010 Client Access server. To export your digital certificate, use the following

steps.

1. Export the digital certificate to the variable $file using the following command.

$file = Export-ExchangeCertificate -Thumbprint

5113ae0233a72fccb75b1d0198628675333d010e -BinaryEncoded:$true -

Password (Get-Credential).password

2. The following command uses the Set-Content cmdlet to write data stored in the variable $file

to the file htcert.pfx.

Set-Content -Path "c:\certificates\htcert.pfx" -Value $file.FileData

-Encoding Byte

To install a digital certificate on an Exchange 2003 server, use the following steps.

1. Copy the exported certificate to a location that can be accessed from the Exchange 2003

server.

2. Click Start, Run, type MMC, and then click OK.

3. In the left hand pane, expand Certificates (Local Computer), and then select the Personal

node.

4. Right-click Certificates, click All Tasks, and then click Import to launch the Certificate

Import Wizard. Click Next.

5. Enter the password you used when you exported the PFX file, select the Mark the private

key as exportable check box and then click Next.

6. Select Automatically select the certificate store based on the type of certificate, click

Next, and then click Finish.

To install a digital certificate on an Exchange 2007 server, use the following steps.

1. Copy the exported certificate to a location that can be accessed from the Exchange 2007

server.

2. Using the Exchange Management Shell, run the following command.

Import-ExchangeCertificate -Path c:\certificates\import.pfx -

Password:(Get-Credential).password

How do I know this worked? The successful completion of the New Exchange Certificate, Complete Pending Request, and

Assign Services to Certificate wizards will be your first indication that the certificate request,

import, and assignment worked as expected. To further verify that your certificate was imported

and assigned correctly, you can perform the following steps from the Exchange 2010 Client

Access server computer.

Page 15: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

15

1. In the Console tree, click Server Configuration.

2. In the Result pane, select the server that contains the certificate, and then in the Work pane,

select the certificate you want to view.

3. From the Actions pane, click Open. You can view information about the certificate on the

General, Details, and Certification Path pages of the Exchange Certificate dialog box.

Enable Exchange 2010 Outlook Anywhere

Estimated time to complete: 15 minutes

Outlook Anywhere eliminates the need for users in remote offices or mobile users to have to use

a VPN to connect to their Exchange servers. Although Outlook Anywhere is an optional

component of Exchange 2010, we recommend its use if you have external clients that will

connect to Exchange 2010. Outlook Anywhere provides access to a user's mailbox via RPC over

HTTPS.

As with any external client access method, there are security implications to consider when

deploying Outlook Anywhere. Before making the decision to deploy Outlook Anywhere, you

should read: Understanding Security for Outlook Anywhere

Learn more at: Understanding Outlook Anywhere

How do I do this? The Enable Outlook Anywhere wizard helps you with this task.

1. In the console tree, navigate to Server Configuration > Client Access.

2. In the action pane, click Enable Outlook Anywhere.

3. On the Outlook Anywhere tab:

Type the external host name or URL for your organization in External host name. The

external host name should be the FQDN you entered when installing the Client Access

server role, which is the existing host name. For example, mail.contoso.com.

Select either Basic authentication or NTLM authentication.

Important:

Don’t select Negotiate Ex authentication. It’s an authentication type that's

reserved for future Microsoft use. If you select this setting, authentication will fail.

If you're using an SSL accelerator and you want to use SSL offloading, select Allow

secure channel (SSL) offloading.

Important:

Don't use this option unless you're sure that you have an SSL accelerator that

can handle SSL offloading. If you don't have an SSL accelerator that can handle

SSL offloading, and you select this option, Outlook Anywhere won't function

correctly.

Page 16: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

16

4. Click Enable to apply these settings and enable Outlook Anywhere.

How do I know this worked? Outlook Anywhere will be enabled on your Client Access server after a configuration period of

approximately 15 minutes. To verify that Outlook Anywhere has been enabled, check the

application event log on the Client Access server. The following events will be logged in the event

log.

EventID 3007 MSExchange RPC over HTTP Autoconfig

EventID 3003 MSExchange RPC over HTTP Autoconfig

EventID 3004 MSExchange RPC over HTTP Autoconfig

EventID 3006 MSExchange RPC over HTTP Autoconfig

You can also use the Exchange Remote Connectivity Analyzer (ExRCA) to verify that Outlook

Anywhere has been enabled and configured correctly. ExRCA is a free Web-based tool provided

by Microsoft. You can find ExRCA at https://www.testexchangeconnectivity.com

Configure OAB and Web Services virtual directories

Estimated time to complete: 10 minutes

To enable Outlook Anywhere clients to discover and automatically connect to Exchange 2010,

you must configure the offline address book (OAB) and Exchange Web Services virtual

directories. This step is only necessary if you'll be using Exchange Web Services, Outlook

Anywhere, or the offline address book. If you haven't enabled Outlook Anywhere, and you don't

plan on using Exchange Web Services for programmatic access to Exchange mailbox

information, you can skip this step.

Learn more at: Understanding Offline Address Books and Configure External Client Access

Namespaces

How do I do this? You must use the Exchange Management Shell to configure OAB and Exchange Web Services

virtual directory settings.

If you're unfamiliar with the Shell, learn more at: Overview of Exchange Management Shell

1. Configure the external URL for the offline address book using the following syntax.

Set-OABVirtualDirectory -Identity "CAS01\OAB (Default Web Site)" -

ExternalUrl https://mail.contoso.com/OAB -RequireSSL:$true

2. Configure the external URL for Exchange Web Services using the following syntax.

Page 17: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

17

Set-WebServicesVirtualDirectory -Identity "CAS01\EWS (Default Web

Site)" -ExternalUrl https://mail.contoso.com/EWS/Exchange.asmx -

BasicAuthentication:$True

How do I know this worked? To verify that these steps were completed successfully, run the following commands to verify the

ExternalURL property is set correctly on both virtual directories.

Get-OABVirtualDirectory -Identity "CAS01\OAB (Default Web Site)"

Get-WebServicesVirtualDirectory -Identity "CAS01\EWS (Default Web

Site)"

Configure virtual directory properties

During the installation of the Client Access server role, virtual directories are created for the

Autodiscover service, Exchange ActiveSync, Outlook Web App, the Exchange Control Panel,

Windows PowerShell, Exchange Web Services, and public folders. Legacy virtual directories are

also created for coexistence. You can configure a variety of settings on those virtual directories,

including authentication and SSL.

Learn more at: Understanding Virtual Directories

How do I do this? Perform the following steps from the computer that has the Exchange 2010 Client Access server

role installed.

1. In the Console tree, navigate to Server Configuration > Client Access.

2. In the Result pane, select the Client Access server you want to configure.

3. In the Work pane, click the tab that corresponds to the virtual directory whose settings you

want to configure (Outlook Web App, Exchange Control Panel, Exchange ActiveSync), and

then click the virtual directory.

4. In the Actions pane, under the virtual directory name, click Properties.

5. Edit any of the settings on the tabs. (If you need more information about the settings, click F1

while you're on a tab.) Common settings to be configured are:

a. External URL This is the URL used to access the Web site from the Internet. The value

for this URL should have been set during installation of the Client Access server role.

b. Authentication You can specify a variety of authentication options, as well as specify

the sign-in format and sign-in domain.

c. Direct File Access For Outlook Web App, you can configure direct file access settings

for public and private computers.

6. Click OK to confirm your changes.

Page 18: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

18

How do I know this worked? How you confirm whether your settings were applied varies by the setting.

To verify that the external URL has been configured correctly for Exchange ActiveSync or

Outlook Web App, you can use the Exchange Remote Connectivity Analyzer (ExRCA), a free

Web-based tool provided by Microsoft.

You can find ExRCA at https://www.testexchangeconnectivity.com

To verify that authentication has been configured correctly for Exchange ActiveSync or

Outlook Web App, you can also use ExRCA.

To verify that direct file access has been configured correctly for Outlook Web App, log on as

a user to Outlook Web App using the public computer option and then try to access and save

a file attached to an e-mail message.

Install the Hub Transport server role

Estimated time to complete: 20 minutes

The Hub Transport server role is responsible for internal mail flow for the Exchange organization.

It handles all mail flow inside the organization, applies transport rules, applies journaling policies,

and delivers messages to recipient mailboxes.

Learn more at: Overview of the Hub Transport Server Role

You can install the Hub Transport server role on dedicated hardware, or you can install it on the

same server where you installed the Client Access server role.

We recommend installing the latest update rollup for Exchange 2010 on all your servers.

Although you can install update rollups on a server after Exchange 2010 has been installed, it's

also possible and less time-consuming to incorporate the update rollup into the install server

installation process. To do this, copy the contents of the Exchange 2010 DVD to the file system,

and then copy or move the downloaded update rollup file to the Updates folder in the installation

tree. When you perform the procedure below, the update rollup will be installed as part of the

initial installation process.

To download the latest update rollup for Exchange 2010, visit: Microsoft Download Center

How do I install the Hub Transport server role on dedicated hardware? The Exchange Server 2010 Setup wizard helps you install the Hub Transport role:

1. Insert the Exchange 2010 DVD into the DVD drive. When the AutoPlay dialog appears, click

Run Setup.exe under Install or run program. If the AutoPlay dialog doesn't appear,

navigate to the root of the DVD and double-click Setup.exe. Alternatively, browse to the

location of your Exchange 2010 installation files and double-click Setup.exe.

Page 19: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

19

2. TheExchange Server 2010 Setup welcome screen appears. In the Install section, the

software listed for Step 1: Install .NET Framework 3.5 SP1 and Step 2: Install Windows

PowerShell v2 was installed with the Exchange 2010 prerequisites. If these prerequisites

aren't already installed, click the appropriate step to install them.

3. When Step1, Step2, and Step3 are listed as Installed, click Step 4: Install Microsoft

Exchange.

Note:

After your installation is complete, you can return to complete Step 5: Get critical

updates for Microsoft Exchange.

4. On the Introduction page, click Next.

5. On the License Agreement page, review the software license terms. If you agree to the

terms, select I accept the terms in the license agreement, and click Next.

6. On the Error Reporting page, select Yes or No to enable the Exchange Error Reporting

feature, and click Next.

7. On the Installation Type page, select Custom Exchange Server Installation. For

Exchange 2010 SP1, you can select to automatically install all required Windows roles and

features for this server. To optionally change the installation path for Exchange 2010, click

Browse, locate the appropriate folder in the folder tree, and then click OK. Click Next.

8. On the Server Role Selection page, select the Hub Transport Role, and click Next. The

Management Tools option, which installs the Exchange Management Console and the

Exchange Management Shell, will also be selected and installed.

Page 20: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

20

9. On the Readiness Checks page, review the Summary to determine if the system and server

are ready for the Hub Transport role to be installed. If all prerequisite checks completed

successfully, click Install. If any of the prerequisite checks failed, you must resolve the

displayed error before you can proceed with installing the Hub Transport role. In many cases,

you don't need to exit Setup while you're fixing issues. After you resolve an error, click Retry

to run the prerequisite check again. Also, be sure to review any warnings that are reported.

10. The Progress page displays the progress and elapsed time for each phase of the

installation. As each phase ends, it's marked completed and the next phase proceeds. If any

errors are encountered, the phase will end as incomplete and unsuccessful. If that happens,

you must exit Setup, resolve any errors, and then restart Setup.

11. When all phases have finished, the Completion page displays. Review the results, and verify

that each phase completed successfully. Clear the check box for Finalize this installation

using the Exchange Management Console, and then click Finish to exit Setup.

12. When you're returned to the Setup welcome screen, click Close. On the Confirm Exit prompt,

click Yes.

13. Restart the computer to complete the installation of the Hub Transport role.

How do I add the Hub Transport server role to my Client Access server? You can also use the Exchange Server 2010 Setup wizard to add the Hub Transport role to your

existing Client Access server.

1. In Control Panel, start Programs and Features.

2. Select Microsoft Exchange Server 2010 from the list of installed programs, and then click

Change.

3. The Exchange Server 2010 Setup wizard starts in Exchange Maintenance Mode. Click Next.

4. On the Server Role Selection page, select the check box for Hub Transport Role and then

click Next.

5. On the Readiness Checks page, review the Summary to determine if the system and server

are ready for the Hub Transport role to be installed. If all prerequisite checks completed

successfully, click Install. If any of the prerequisite checks failed, you must resolve the

displayed error before you can proceed with installing the Hub Transport role. In many cases,

you don't need to exit Setup while you're fixing issues. After you resolve an error, click Retry

to run the prerequisite check again. Also, be sure to review any warnings that are reported.

6. The Progress page will display the progress and elapsed time for each phase of the

installation. As each phase ends, it will be marked completed and the next phase will

proceed. If any errors are encountered, the phase will end as incomplete and unsuccessful.

In this event, you must exit Setup, resolve any errors, and then restart Setup in Maintenance

Mode.

7. When all phases have finished, the Completion page will be displayed. Review the results

and verify that each phase completed successfully. Click Finish to exit Setup.

Page 21: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

21

8. Restart the computer to complete the installation of the Hub Transport role.

How do I know this worked? The successful completion of the Exchange Setup wizard will be your first indication that the

installation process worked as expected. To further verify that the Hub Transport server

role installed successfully, you can run Get-ExchangeServer <server name> | Format-

List in the Exchange Management Shell, which can be launched from the Exchange Server

2010 program group on the Windows Start Menu. This cmdlet outputs a list of the Exchange 2010

server roles that are installed on the specified server.

You can also review the contents of the Exchange setup log file (ExchangeSetup.log), located in

<system drive>\ExchangeSetupLogs to verify that the Hub Transport role was installed as

expected.

Learn more at: Verify an Exchange 2010 Installation

Configure a legacy host name

Estimated time to complete: 20 minutes

You need to create a legacy domain name system (DNS) host name so your legacy Exchange

environment (Exchange 2003 and/or Exchange 2007) and Exchange 2010 can coexist. For

example, if your domain name is currently contoso.com, you're likely using a host name of

mail.contoso.com or www.contoso.com for external client access to Exchange. During

coexistence, we recommend creating and using, for example, a host name of

legacy.contoso.com. This host name should be configured the same way your primary host name

is configured. You'll associate the legacy host name with your existing Exchange server and

associate your current host name (for example, mail.contoso.com) with your Exchange 2010

Client Access server or array. Your end users will not see or use the legacy host name. It will be

used by Autodiscover and Client Access servers when redirecting legacy users to a legacy

server.

All client connections will be redirected, including Exchange ActiveSync, Outlook Web App,

POP3, and IMAP4. After the legacy host name has been configured, users will be able to access

their mailbox regardless of whether it's on Exchange 2010 or Exchange 2003. If you're upgrading

from Exchange 2007 to Exchange 2010 or from an environment that contains both Exchange

2007 and Exchange 2003, Availability service requests will also be redirected. In addition, after

you configure a legacy host name, you'll also need to ensure that your digital certificates are

configured with the legacy host names.

Learn more at: Understanding DNS Requirements and Understanding Digital Certificates and

SSL

Page 22: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

22

How do I do this? The steps to perform this task will vary for each organization. That's because the exact steps

depend on your Internet provider and firewall configuration. Example steps for GoDaddy are

provided below just to give you an idea of how things work. Your actual steps may vary. But, in

general, you need to:

1. Create a DNS host (A) record in your internal and external DNS servers that points to the IP

address of your legacy Internet-facing Exchange server (for example, Exchange 2007 Client

Access server, Exchange 2003 front-end server, etc.) in internal DNS or the public IP

address on your reverse proxy or firewall solution (external DNS). The host name should be

in the format of legacy.domain.com (for example, legacy.contoso.com).

2. Create a publishing rule for the legacy host name in your reverse proxy or firewall solution to

point to your legacy Internet-facing Exchange server. Refer to your proxy/firewall solution's

user manual for instructions on how to do this.

3. Configure the existing DNS host (A) record in your internal and external DNS servers for your

original host name (for example, mail.contoso.com) to point to your Exchange 2010

organization; for example, the IP address of your Client Access server or array (internal

DNS), or the public IP address on your reverse proxy or firewall solution (external DNS).

So, for example, if your provider is GoDaddy.com, here's how you create a DNS host (A) record

and associate it with your legacy Exchange infrastructure:

1. From your GoDaddy account management home page, click Domain Manager under the My

Products heading in the left sidebar.

2. If prompted, log in to your account.

3. In the Total DNS section of the Domain Manager information screen, click Total DNS

Control.

4. In the A (Host) section of the Total DNS Control screen click Add new A record.

5. Enter the host name, for example legacy.contoso.com and enter the IP address of your

legacy Exchange server in the Points to IP address box.

6. Choose a TTL (time to live) value. If you're performing this step well in advance of your

Exchange 2010 installation, you can choose 1 day or 1 week from the drop-down list box.

Otherwise, choose the default of 1 hour or 1/2 hour.

7. Click OK to complete your changes.

If your Exchange 2003 server isn’t currently configured to use SSL for client access, you’ll need

to enable SSL to secure the communications between the client messaging applications and the

Exchange front-end server. Learn more at: Exchange Server 2003 Client Access Guide

How do I know this worked? From outside your firewall, perform the following steps, using your specific domain name.

1. Navigate to https://mail.contoso.com/owa, and verify that you can access Outlook Web App

for a user whose mailbox is on Exchange 2010.

Page 23: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

23

2. Navigate to https://legacy.contoso.com/exchange, and verify that you can access Outlook

Web Access for a user whose mailbox is on a legacy Exchange server.

3. Navigate to https://mail.contoso.com/owa, and verify that you can access Outlook Web App

for a user whose mailbox is on a legacy Exchange server.

You can also use the Exchange Server Remote Connectivity Analyzer to verify connectivity for

the legacy namespace.

You'll find ExRCA at: https://www.testexchangeconnectivity.com

Install the Mailbox server role

Estimated time to complete: 20 minutes

The Mailbox server role hosts mailbox and public folder databases, and it generates the offline

address book (OAB). Mailbox servers also provide services that enforce e-mail address policies

and managed folders.

Learn more at: Overview of the Mailbox Server Role

You can install the Mailbox server role on dedicated hardware, or you can install it on a server

that is already running Exchange 2010.

We recommend installing the latest update rollup for Exchange 2010 on all your servers.

Although you can install update rollups on a server after Exchange 2010 has been installed, it's

also possible and less time-consuming to incorporate the update rollup into the install server

installation process. To do this, copy the contents of the Exchange 2010 DVD to the file system,

and then copy or move the downloaded update rollup file to the Updates folder in the installation

tree. When you perform the procedure below, the update rollup will be installed as part of the

initial installation process.

To download the latest update rollup for Exchange 2010, visit: Microsoft Download Center

How do I install the Mailbox server role on dedicated hardware? The Exchange Server 2010 Setup wizard helps you install the Mailbox role.

1. Insert the Exchange 2010 DVD into the DVD drive. When the AutoPlay dialog appears, click

Run Setup.exe under Install or run program. If the AutoPlay dialog doesn't appear,

navigate to the root of the DVD and double-click Setup.exe. Alternatively, browse to the

location of your Exchange 2010 installation files and double-click Setup.exe.

2. TheExchange Server 2010 Setup welcome screen appears. In the Install section, the

software listed for Step 1: Install .NET Framework 3.5 SP1 and Step 2: Install Windows

PowerShell v2 was installed with the Exchange 2010 prerequisites. If these prerequisites

aren't already installed, click the appropriate step to install them.

3. When Step1, Step2, and Step3 are listed as Installed, click Step 4: Install Microsoft

Exchange.

Page 24: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

24

Note:

After your installation is complete, you can return to complete Step 5: Get critical

updates for Microsoft Exchange.

4. On the Introduction page, click Next.

5. On the License Agreement page, review the software license terms. If you agree to the

terms, select I accept the terms in the license agreement, and click Next.

6. On the Error Reporting page, select Yes or No to enable the Exchange Error Reporting

feature, and click Next.

7. On the Installation Type page, select Custom Exchange Server Installation. For

Exchange 2010 SP2, you can select to automatically install all required Windows roles and

features for this server. To optionally change the installation path for Exchange 2010, click

Browse, locate the appropriate folder in the folder tree, and then click OK. Click Next.

8. On the Server Role Selection page, select the Mailbox Role, and click Next. The

Management Tools option, which installs the Exchange Management Console and the

Exchange Management Shell, will also be selected and installed.

Important:

If you're installing the Mailbox server role, the Task Scheduler must be enabled and

running. In addition, if the Mailbox server will be a member of a DAG and host

replicated databases, it’s required that the script is scheduled and run automatically.

Page 25: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

25

9. On the Client Settings page, select Yes if your organization has client computers running

either Microsoft Outlook 2003 or Microsoft Entourage 2004 or earlier. Select No if you don't.

10. On the Readiness Checks page, review the Summary to determine if the system and server

are ready for the Mailbox role to be installed. If all prerequisite checks completed

successfully, click Install. If any of the prerequisite checks failed, you must resolve the

displayed error before you can proceed with installing the Mailbox role. In many cases, you

don't need to exit Setup while you're fixing issues. After you resolve an error, click Retry to

run the prerequisite check again. Also, be sure to review any warnings that are reported.

11. The Progress page displays the progress and elapsed time for each phase of the

installation. As each phase ends, it's marked completed and the next phase proceeds. If any

errors are encountered, the phase will end as incomplete and unsuccessful. If that happens,

you must exit Setup, resolve any errors, and then restart Setup.

12. When all phases have finished, the Completion page displays. Review the results, and verify

that each phase completed successfully. Clear the check box for Finalize this installation

using the Exchange Management Console, and then click Finish to exit Setup.

13. When you are returned to the Setup welcome screen, click Close. On the Confirm Exit

prompt, click Yes.

14. Restart the computer to complete the installation of the Mailbox role.

How do I add the Mailbox server role to an existing Exchange 2010 server? You can also use the Exchange Server 2010 Setup wizard to add the Mailbox role to an existing

Exchange 2010 server.

1. In Control Panel, start Programs and Features.

2. Select Microsoft Exchange Server 2010 from the list of installed programs, and then click

Change.

3. The Exchange Server 2010 Setup wizard starts in Exchange Maintenance Mode. Click Next.

4. On the Server Role Selection page, select the check box for Mailbox Role and then click

Next.

5. On the Readiness Checks page, review the Summary to determine if the system and server

are ready for the Mailbox role to be installed. If all prerequisite checks completed

successfully, click Install. If any of the prerequisite checks failed, you must resolve the

displayed error before you can proceed with installing the Mailbox role. In many cases, you

don't need to exit Setup while you're fixing issues. After you resolve an error, click Retry to

run the prerequisite check again. Also, be sure to review any warnings that are reported.

6. The Progress page will display the progress and elapsed time for each phase of the

installation. As each phase ends, it will be marked completed and the next phase will

proceed. If any errors are encountered, the phase will end as incomplete and unsuccessful.

In this event, you must exit Setup, resolve any errors, and then restart Setup in Maintenance

Mode.

Page 26: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

26

7. When all phases have finished, the Completion page will be displayed. Review the results

and verify that each phase completed successfully. Click Finish to exit Setup.

8. Restart the computer to complete the installation of the Mailbox role.

How do I know this worked? The successful completion of the Exchange Setup wizard will be your first indication that the

installation process worked as expected. To further verify that the Mailbox server role installed

successfully, you can run Get-ExchangeServer <server name> | Format-List in the

Exchange Management Shell, which can be launched from the Exchange Server 2010 program

group on the Windows Start Menu. This cmdlet outputs a list of the Exchange 2010 server roles

that are installed on the specified server.

You can also review the contents of the Exchange setup log file (ExchangeSetup.log), located in

<system drive>\ExchangeSetupLogs to verify that the Mailbox role was installed as expected.

Learn more at: Verify an Exchange 2010 Installation

Move OAB generation to Exchange 2010

Estimated time to complete: 20 minutes

Offline address book (OAB) generation is the process by which Exchange creates and updates

the OAB. To do that, an internal process called OABGen runs on a Mailbox server that has been

designated as the OAB generation server. When OAB generation occurs, Exchange generates

new OAB files, compresses the files, and then shares the files to client computers.

Outlook 2003 and earlier clients require OAB distribution to occur using public folders. In

Exchange 2010, OABs can be distributed using public folders to support Outlook 2003 clients.

OABs can also be distributed using Web services to support Outlook 2007 and Outlook 2010.

To ensure full functionality with Exchange 2010 features, we recommend that you move the OAB

generation to an Exchange 2010 mailbox server. Moving the OAB generation from Exchange

2007 to Exchange 2010 results in a full OAB download for all clients.

Learn more at: Understanding Offline Address Books

How do I do this? You can use the Move Offline Address Book wizard in the Exchange Management Console to

perform this procedure.

1. In the Console tree, navigate to Organization Configuration > Mailbox.

2. In the Result pane, click the Offline Address Book tab, and then select the OAB for which

you want to move generation to a new server.

3. In the Actions pane, click Properties. On the Distribution tab, select the Enable Web-

based distribution and the Enable public folder distribution check boxes and then click

OK.

Page 27: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

27

4. In the Actions pane, click Move.

5. On the Move Offline Address Book page, click Browse to select the server to which you

want to move the OAB generation process, and then click OK.

6. Click Move to move the OAB generation process to the selected server.

7. On the Completion page, verify that the operation completed successfully. Click Finish to

close the Move Offline Address Book wizard.

How do I know this worked? The successful completion of the Move Offline Address Book wizard will indicate that the

command worked as expected. To further verify that the OAB generation server is the server

selected in Step 5 above, examine the value for Generation Server on the Offline Address

Book tab in the Exchange Management Console.

Move Exchange 2007 mailboxes to Exchange 2010

Estimated time to complete: 20 minutes

A move request is the process of moving a mailbox from one mailbox database to another. A

local move request is a mailbox move that occurs within a single forest.

Consider the following when moving mailboxes from Microsoft Exchange Server 2007 Service

Pack 3 (SP3) to Exchange 2010:

You can't move mailboxes from Exchange 2007 SP2 or earlier. The source Mailbox server

must be running Exchange 2007 SP3 or later.

The move process is performed online, and end users can access their mailboxes during the

move.

How do I do this? Use the Exchange Management Console to create local move requests and move mailboxes

from Exchange 2007 to Exchange 2010.

1. In the console tree, navigate to Recipient Configuration > Mailbox.

2. In the result pane, select one or more mailboxes that you want to move.

3. In the action pane, click New Local Move Request.

4. On the Introduction page, configure the following settings:

A new move request will be placed for the following mailboxes This box displays

the mailboxes that you selected in the result pane. If you want to add or remove

mailboxes, click Cancel, and then make the changes in the result pane.

Page 28: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

28

Target mailbox database Click Browse to open the Select Mailbox Database dialog

box. Use this dialog box to select the target mailbox database to which you want to move

the mailboxes. Click OK to return to the wizard.

5. On the Move Options page, specify how you want to manage corrupted messages if they

are found.

Skip the mailbox Select this option to specify that mailboxes containing corrupted

messages will not be moved. We recommend selecting this option. Only select Skip the

corrupted messages if the move request failed in a previous attempt.

Skip the corrupted messages Select this option to move the mailbox, but not to move

any corrupted messages. If you select this option, you'll need to set the Maximum

number of messages to skip. We recommend that you select the Skip the mailbox

option unless the mailbox move failed in a previous attempt.

Maximum number of messages to skip If you select Skip the corrupted messages,

use this list to specify a number between -1 and 2,147,483,647. Use -1 to skip an

unlimited number of corrupted messages.

6. On the New Local Move Request page, review your configuration settings. Click New to

create the move request. Click Back to make changes.

7. On the Completion page, review the following, and then click Finish to close the wizard:

A status of Completed indicates that the wizard completed the task successfully.

A status of Failed indicates that the task wasn't completed. If the task fails, review the

summary for an explanation, and then click Back to make any configuration changes.

How do I know this worked? The successful completion of the New Local Move Request wizard will be your first indication that

the mailbox was moved successfully. You can further verify that the move operation was

successful by performing any of the following tasks:

Examine the properties of the mailbox in the recipients work pane. To do this, right-click the

mailbox and select Properties. The database hosting the mailbox is displayed in the Mailbox

database field on the General tab.

Run the Get-Mailbox cmdlet to view a list of all mailboxes on the Exchange 2010 database.

For example, you could run:

Get-Mailbox -Database DB1

Or, for example:

Get-Mailbox -Server EX2

Have each user whose mailbox was moved try to open their mailbox and verify the contents,

as well as try to send and receive messages.

Page 29: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

29

Post-installation tasks

After you complete a new installation of Exchange 2010 or after you add an additional Exchange

2010 server role to an existing Exchange 2010 server, you should complete the post-installation

tasks. The post-installation tasks will help you verify the installation and configure the

components that you have just installed.

Tasks to complete on all server roles For all server roles, we recommend that you verify the installation immediately after you install

Exchange 2010. If you install the Hub Transport or Edge Transport server roles, you should also

verify the agent configuration. For more information, see the following topics:

Verify an Exchange 2010 Installation

Enter Product Key

Transport Server Post-Deployment Tasks

Finalize Deployment Tasks

End-to-End Scenario Tasks

Additional Post-Installation Tasks

If you're upgrading from an Exchange 2003 or a mixed Exchange 2003 and Exchange 2007

organization, see: Upgrade Custom LDAP Filters to OPATH Filters

Optional tasks to complete on the Mailbox server role After deploying and verifying the successful installation of at least two Mailbox servers, you can

configure your Mailbox servers and mailbox databases for high availability and site resilience.

Exchange 2010 uses the concept of incremental deployment, which is the ability to configure high

availability and site resilience for Mailbox servers after the servers have been deployed. Service

and data redundancy is achieved by using new features in Exchange 2010 such as database

availability groups and database copies.

For more information about configuring your Mailbox servers for high availability or site resilience,

see: Managing High Availability and Site Resilience

Optional tasks to complete on the Hub Transport server role After deploying and verifying the installation of the Hub Transport server role, you might be

interested in enabling anti-spam functionality on your Hub Transport server. In some small

organizations, it may make sense to run Exchange 2010 anti-spam features on Hub Transport

servers. For example, some organizations may not have enough e-mail volume to justify the cost

of installing and maintaining a full perimeter network together with an Edge Transport server.

Page 30: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

30

Learn more at: Enable Anti-Spam Functionality on a Hub Transport Server

Optional tasks to complete on the Unified Messaging server role After deploying and verifying the installation of your Unified Messaging (UM) server(s), you might

be interested in integrating UM services with Microsoft Office Communications Server (OCS)

2007 R2. Exchange 2010 UM combines voice messaging and e-mail messaging into a single

messaging infrastructure. Enterprise Voice in OCS 2007 R2 makes use of the UM infrastructure

to provide call answering, subscriber access, call notification, and auto attendant services.

Implementing these services requires integrating Exchange UM and OCS in a shared Active

Directory topology, careful planning, and a clear understanding of the technologies involved, the

features you want to enable, and important configuration details that you must be aware of to

successfully complete your deployment.

For more information about integrating UM with OCS, see: Enterprise Voice and Unified

Communications

Permissions configuration For the purposes of the Exchange Deployment Assistant, your administrator account was granted

permissions that you might not need going forward. You should verify that this account doesn't

have more permissions than required to configure and manage your Exchange 2010

environment.

Role Based Access Control (RBAC), the new permissions model in Exchange 2010, is extremely

flexible. The built-in role groups are probably sufficient to manage most of your Exchange 2010

organization. You can simply add and remove members from the existing role groups to control

permissions. The following topics will provide more information and help you configure the

appropriate permissions for your Exchange 2010 tasks:

Understanding Permissions

Understanding Role Based Access Control

Understanding Management Role Groups

Understanding Management Role Scopes

Built-in Role Groups

Built-in Management Roles

Understanding Permissions Coexistence with Exchange 2003

Remove legacy Exchange versions After you have completed deploying Exchange 2010 into your organization, you may be ready to

remove previous versions of Exchange. For more information about removing legacy Exchange

servers, see the following topics:

How to Uninstall Exchange Server 2003

Page 31: Contentsdownload.microsoft.com/download/C/3/E/C3EC73A8-A... · Schema master The latest 32-bit or 64-bit edition of the Windows Server 2003 Service Pack 1 (SP1) Standard or Enterprise

31

How to remove Exchange Server 2003 from your computer

How to Completely Remove Exchange 2007 from a Server

Checklist complete

Congratulations on successfully completing your checklist in the Exchange Deployment Assistant!

Tools you can use To determine the overall health of your Exchange servers and topology, you can use the

Microsoft Exchange Best Practices Analyzer (ExBPA). The tool scans Exchange servers and

identifies items that don't conform to Microsoft best practices. After the data is collected, ExBPA

compares what it finds on your system with Exchange best practice rules and then provides a

detailed report. The report lists recommendations that you can consider to achieve greater

performance, scalability, and uptime. You can find ExBPA in the Toolbox in the Exchange

Management Console.

The Exchange Remote Connectivity Analyzer Tool is a Web-based tool that helps you

troubleshoot connectivity issues. The tool simulates several client logon and mail flow scenarios.

When a test fails, many of the errors have troubleshooting tips to assist you in correcting the

problem.

Take a look at: Exchange Remote Connectivity Analyzer Tool

And, for more information about Exchange planning and deployment, you can always review the

related content in the Exchange TechCenter Library.

Find it all at: Planning and Deployment

Give us feedback please We would really appreciate your feedback about the Exchange Deployment Assistant. What

worked for you? What could we have done better? What do you recommend we change for the

next version?

Tell us what you think at: Feedback: Exchange 2010 Deployment Assistant