Resource Forest, Account Forest - Exchange Removal questions.

[Robert Bollinger]

Hey Guys, 

This is a strange one i have never come across before so please assist if you can. At this time i want to better understand what needs to be done to remove the Resource Forest (de-couple it from the account forest) and what pitfalls might be encountered. 

Here is the scenario: 

1)  Customer has Hybrid setup between the resource forest/account forest. And connected to office 365. Did not use HCW to setup hybrid, set it up manually.

2)  Mailboxes have all been migrated from the Resource Forest to Office 365.

3) Has their own tenant, has a 2 forests added (to ad connect), account and resource, account forest data provides account attributes, resource provide exchange attributes.

4) All mailboxes are in the cloud, Customer also has Skype for Business On-Prem. 

Question: Customer wants to remove their resource forest, while continuing to keep their account forest and wants to be able to "Manage" user objects using an exchange server in the account forest, and also keep ad connect. 

I am not sure how best to approach this, while i have worked with Resource forests in the past, its been a while. 

I have seen several links that cover this, but nothing explains whats going on what could go wrong etc. 

Any ideas? 

Thanks, 

Robert 

@Tony Redmond if you could review the question for me please. I just wanted to get some input on it, not asking you to fix anything. thanks in advance. 

[#2]

@Robert Bollinger  I am afraid that I am no help here. It's been a long time since I even looked at a resource forest and I have no test lab to play with that has a resource forest.

[#3]

@Tony Redmond 

Ok thanks for the response. Do you know who might be able to take a look at this and do a quick review? I found several links on this, namely fro Japp W. But as with all things exchange things aren't always what they seem. 

https://jaapwesselius.com/2018/04/25/exchange-resource-forest-and-office-365-part-i/comment-page-1/?...

The reason why i am asking is because this is for a large enterprise business. so i want to get some additional input. 

Robert

[#4]

@Robert Bollinger  Brian Desmond, Michael Van Horenbeeck, Jaap W, Jeff Guillet... all do work with on-premises servers.

[#5]

@Tony Redmond Thanks again tony. @BrianDesmond @Paul Cunningham 

I worked a little on the issue over the weekend, and setup a new test environment. Exchange 2013, new office 365 tenant. Setup a standard resource forest/account forest. I have been commenting on one of Jaap's posts. my comments all the way at the bottom. 

https://jaapwesselius.com/2018/04/25/exchange-resource-forest-and-office-365-part-i/

• I wonder if ADMT might work here? 
• How would one install Exchange in the Account forest? (To manage objects, once the Resource Forest is gone). 

Since AD connect would be installed in the account forest and then connected to both Environment's Directories for sync purposes, I thought ADMT might do the job, but i just cant be sure. Tomorrow i am going to see if/what i can test. 

Brian, Tony Redmond said you may be able to assist. Paul, you have provided valuable insight in the past which is why i suffered you into this. Thanks in advance. 

Robert

[#6]

@Robert Bollingerif I follow what you want to do is remove the resource forest, which contains all of the Exchange attributes? 

You'll need to copy all of those over to the objects in the account forest so they look like remote mailboxes there, and then you'll probably find it easier to setup a new AAD Connect that only talks to the account forest. There are various ways to copy the attributes over, but using a script is probably easiest. You can setup the new AAD Connect server in staging mode and look at the pending exports to make sure you have everything copied over. 

Thanks,

Brian

[#7]

Thanks Brian. Yes. That is correct. The customer wants to completely remove the resource forest and the corresponding AD Domain as well.

However one last point to this is the customer also wants to be able to use Exchange in the Account Forest - to manage objects.

in my lab AD connect has been installed in the account forest and connected to the resource forest as well as the account forest (so 2 AD's). Was that the right thing to do? or should i have installed it in the Resource Forest?

Also, why cant i use ADMT to migrate the user accounts over and effectively merge them?

Thanks,

Robert

[#8]

@Robert Bollinger 

If you just take the attributes 1:1 from the resource forest to the account forest, you're not going to have what you want. You have (or had) linked mailboxes in the resource forest. You want a plain remote mailbox in the account forest.

ADMT also hasn't been updated in a very, very long time. It may or may not actually work for you regardless of the issue above.

You'll need to put an Exchange server in the account forest for this to work. 

[#9]

@BrianDesmond Thanks again. 

To be clear for myself on this process, and to make sure i have the order right, with all mailboxes already migrated  to office 365, I should do the following: 

1. Install Exchange in the Account Forest, creating a new exchange org.
2. Copy MSExchange Attributes over, I will work to copy the correct ones over as i know not all need to be copied. Account should show as "office 365" mailbox in EAC in the account forest, and should show as "RemoteUserMailbox" when checking in EMS.
3. Uninstall Exchange from the Resource Forest

Is that about right? I will of course test everything in my lab, before making any changes on the customers environment, and may reach out to PFE for a design review to be doubly sure. 

The customer also needs to migrate all their groups to office 365 as well, however for that i think the correct course of action is to create a script (or find one) that simply creates the groups in the cloud, re-assigns all group memberships and send as, send on behalf of settings, and group security settings. 

The group portion would probably need to be done first, I would imagine. 

Thanks again!!

Robert 

[#10]

@Robert BollingerSounds about right. Don't forget to copy proxyAddresses and legacyExchangeDN values as X500 proxies on users and groups to preserve autocomplete reply-ability. 

[#11]

@Robert Bollinger did you get this working? I have exactly the same scenario and just wanted to check if those steps worked or if you found out anything else that needs to be considered?

[#12]

I think this is pretty well documented here
https://jaapwesselius.com/2020/11/28/decommission-an-exchange-resource-forest-in-a-hybrid-environmen...