Answer for How do MAPI permissions work for migration and sync?
Priasoft recommends the use of cached credentials for migrations. The use of cached credentials allows separate control of access to Exchange data and, for Exchange 2010 and later, allows for the inclusion in Throttling Policies that have no limits imposed. Throttling policies do not allow assignment of members to remote forest users. As such, a trusted account in one forest would be considered “anonymous” to another forest’s domain and would cause the hard-coded, built-in default throttling policy to be used – which is very restrictive and unchangeable.
Here is a screenshot of the Credential Manager from windows:
Credential Manager
Simply put, most setups should then have 4 different accounts in use for migration:
- One account in the TARGET for Active Directory work: e.g. TARGET\migadmin_ldap_target
- One account in the TARGET for MAPI work: e.g. TARGET\migadmin_exch_target
- One account in the SOURCE for Active Directory work: e.g. SOURCE\migadmin_ldap_source
- One account in the SOURCE for MAPI work: e.g. SOURCE\migadmin_exch_source
Account #1 above would be used in any Priasoft tool that asks for a Target Domain Controller and credentials.
Account #2 above would be used to logon to the migration host – be sure it has been added to the local administrators group prior to logon.
Account #3 above would be used in any Priasoft tool that asks for a Source Domain Controller and credentials.
Account #4 above would be added to the Credential manager (on the migration host) and would provide access to the source environment.
*** Note that server names are used for cached credentials. MAPI and many RPC based applications/technologies still use NetBIOS and as such may try to access servers by name-only. This means that for each source Exchange server, 2 entries are needed: one for the NetBIOS name of the server, and one for the fully qualified DNS name of the server.
The Priasoft setup guide (link) describes the setup in detail and give plenty of background as well.
