Using Microsoft Identity Manager Synchronisation Server's Global Address List Synchronisation feature to create a shared global address book across three Exchange Forests

First published at https://nivleshc.wordpress.com

Introduction

Over the life of a company, there can be many acquisitions and mergers. During such events, the parent and the newly acquired entities have their IT “merged”. This allows for the removal of redundant systems and the reduction of expenses. It also fosters collaboration between the two entities. Unfortunately, the marriage of the two IT systems, can at times, take a long time.
To enable a more collaborative space between the parent and the newly acquired company, a shared “global address book” can be created, which will allow employees to quickly look up each others contact details easily.
In this blog, I will show how we can use Microsoft Identity Manager (MIM) 2016 Synchronisation Server’s  GALSync feature to extend the Global Address Book (GAL) of three Exchange Forests. The GAL will be populated with contacts corresponding to  mailboxes in the other Exchange Forests, and this will be automatically maintained, to ensure the contacts remain up-to-date.
Though this blog focuses on three Exchange Forests, it can easily be adapted for two Exchange Forests, if you remove all reference to the third AD Forest, AD Domain and Exchange Forest
For reference, we will be using the following:

Name: Contoso Limited (parent company)
Active Directory Forest: contoso.com
Active Directory Domain: contoso.com
Active Directory Forest Level: Windows Server 2008 R2
Exchange Server FQDN: CEX01.contoso.com
Exchange Server Version: Exchange 2010 SP3
Email Address Space owned: contoso.com, contoso.com.au
Number of employees: 2000
Name: Northwind Traders (newly acquired)
Active Directory Forest: northwind.com
Active Directory Domain: northwind.com
Active Directory Forest Level: Windows Server 2008 R2
Exchange Server FQDN: NWEX01.northwind.com
Exchange Server Version: Exchange 2010 SP3
Email Address Space owned: northwind.com, northwind.com.au
Number of employees: 400
Name: WingTip Toys (newly acquired)
Active Directory Forest: wingtiptoys.com
Active Directory Domain: wingtiptoys.com
Active Directory Forest Level: Windows Server 2008 R2
Exchange Server FQDN: WTTEX01.wingtiptoys.com
Exchange Server Version: Exchange 2010 SP3
Email Address Space owned: wingtiptoys.com, wingtiptoys.com.au
Number of employees: 600

 
Contoso, Northwind and WingTip Toys are connected using a wide area network and it has been decided that the MIM Synchronisation Server will be installed and configured in the the Contoso domain.

Preparation

Before we start, some preparation work has to be done to ensure there are no roadblocks or issues.

• Cleanup of “inter forest” email objects
  • This is one of the most important things that must be done and I can’t stress this enough. You will have to go through all your email objects (mailboxes, contacts, mailuser objects) in each of the three Exchange Forests (Contoso, Northwind, WingTip Toys) and find any that are forwarding to the other Exchange forests. If there are any, these must be removed. GALSync will create email enabled contacts corresponding to the mailboxes in the other Exchange Forests, with  externalemailaddress of these new objects set to the primary email address of the other Exchange Forest’s objects. If duplicates arise because there were existing objects in the local Exchange Forest corresponding to the other Exchange Forest’s objects, this will cause the local Exchange Server to get confused and it will keep on queuing emails for these objects and will not deliver them [if after implementing GALSync, some users complain about not receiving emails from a certain Exchange Forest, this could be a possible reason]
• Creation of Organisational Units (OU) that will be used by GALSync
  • Create the following Organisational Units in the three Active Directory domains
    • contoso.com\GALSync\LocalForest\Contacts
    • contoso.com\GALSync\RemoteForest\Contacts
    • northwind.com\GALSync\LocalForest\Contacts
    • northwind.com\GALSync\RemoteForest\Contacts
    • wingtiptoys.com\GALSync\LocalForest\Contacts
    • wingtiptoys.com\GALSync\RemoteForest\Contacts
• Service Accounts
  • The following service accounts must be created in the specified Active Directory domains. You can change the name to comply with your own naming standards
    • MIM Synchronisation Server Service Account
      • UPN: svc-mimsync@contoso.com
      • AD Domain to create in: contoso.com
      • Permissions: non-privileged Active Directory service account
    • Management Agent Account to connect to Contoso.com AD Domain
      • UPN: svc-mimadma@contoso.com
      • AD Domain to create in: contoso.com
      • Permissions
        • non-privilged Active Directory service account
        • Grant “Replicating Directory Changes” permission
        • Grant the following permissions on the GALSync OU in the Contoso AD Domain that was created above. Ensure the permissions propagate to all sub-OUs within the GALSync OU
          • Create Contact Objects
          • Delete Contact Objects
          • Read all Properties
          • Write all Properties
        • Add to the Exchange Organization Management Active Directory security group in Contoso AD Domain
    • Management Agent Account to connect to Northwind.com AD Domain
      • UPN: svc-mimadma@northwind.com
      • AD Domain to create in: nothwind.com
      • Permissions
        • non-privilged Active Directory service account
        • Grant “Replicating Directory Changes” permission
        • Grant the following permissions on the GALSync OU in the Northwind AD Domain that was created above. Ensure the permissions propagate to all sub-OUs within GALSync OU
          • Create Contact Objects
          • Delete Contact Objects
          • Read all Properties
          • Write all Properties
        • Add to the Exchange Organization Management Active Directory security group in Northwind AD Domain
    • Management Agent Account to connect to WingTiptoys.com AD Domain
      • UPN: svc-mimadma@wingtiptoys.com
      • AD Domain to create in: wingtiptoys.com
      • Permissions
        • non-privilged Active Directory service account
        • Grant “Replicating Directory Changes” permission
        • Grant the following permissions on the GALSync OU in the WingTipToys AD Domain that was created above. Ensure the permissions propagate to all sub-OUs within GALSync OU
          • Create Contact Objects
          • Delete Contact Objects
          • Read all Properties
          • Write all Properties
        • Add to the Exchange Organization Management Active Directory security group in Northwind AD Domain
    • Service account used for the scheduled task job that will run the MIM RunProfiles script on the MIM Synchronisation Server
      • UPN: svc-mimscheduler@contoso.com
      • AD Domain to create in: Contoso.com (this can also be a local account on the MIM Synchronisation Server)
      • Permissions
        • non-privileged Active Directory service account
        • Grant “Log on as a batch job” user right on the MIM Synchronisation Server
        • Add to FIMSyncOperators security group on the MIM Synchronisation Server (this security group is created locally on the MIM Synchronisation Server after MIM Synchronisation Server has been installed)
• SQL Server Permissions
  • MIM Synchronisation Server requires a Microsoft SQL Server to host its database. On the SQL Server, grant SQL SYSADMIN role to the account that you will be logged on as when installing MIM Synchronisation Server

Configuration

Provision a Microsoft Windows Server 2012 R2 in the Contoso.com Active Directory domain and install MIM 2016 Synchronisation Server. During installation, specify svc-mimsync@contoso.com as the account under which the MIM Synchronisation Service will run.
One thing to note is that GALSync will update the proxyaddress field for all mailboxes in its scope (mailboxes for which it will be creating contacts in the other Exchange Forests) with X500 entries.

Management Agent Configuration

1. Once the MIM Synchronisation Server has been successfully installed, use the following steps to create the GALSync Management Agents. Open the Synchronisation Service Manager
   • Create GALSync Management Agent for Contoso.com AD Forest
     • From Tools menu, click Management Agents and then click Create
     •  In the Management Agent drop-down list, click Active Directory global address list (GAL) 
     • In the name type GALSyncMA for Contoso.com
     • On the Connect to an Active Directory Forest page, type the forest name, the MIM MA account details (svc-mimadma@contoso.com) and the domain name
     • In the next screen, specify the OUs that GALSync will query to find mailboxes to create contacts for in the other forests. Also, place a tick beside contoso.com\GALSync (this selects GALSync and all sub-OUs)
     • In the Containers screen, for
     • • Target Container select Contoso.com\GALSync\RemoteForest\Contactsthis is the OU where MIM GALSync will create contacts corresponding to the mailboxes in Northwind and WingTipToys Exchange Forest
       • Source Container select Contoso.com\GALSync\LocalForest\Contactsthis is where MIM GALSync will create contacts corresponding to Contoso.com mailboxes. These will be sent to the GALSync/RemoteForest/Contacts OU in Northwind and WingTipToys AD Domain (personally, I haven’t seen any objects created in this OU)
     • In Exchange Configuration click Edit and enter all the email suffixes that belong to Contoso.com. The email suffixes listed here are used to filter out which email addresses from the original email object are added to the corresponding contact in the other Exchange Forests. In this case the email suffixes will be @contoso.com and @contoso.com.au. Note the @ before the email suffix)
     • Leave everything else as default and proceed to the Configure Extensions section. One thing I would like to mention here is that in Configure Connection Filter section, the Filter Type for user is supposed to be Declared (and is the default setting), not Rules extension as stated in https://technet.microsoft.com/en-us/library/cc708642(v=ws.10).aspx
     • In the Configure Extensions section, set the following
       • Rules extension name: GALSync.dll (this should already be set)
       • Provision for: Exchange 2010
       • Exchange 2010 RPS URI: http://CEX01.contoso.com/Powershell
     • Click OK
   • Create GALSync Management Agent for Northwind.com AD Forest
     • From Tools menu, click Management Agents and then click Create
     •  In the Management Agent drop-down list, click Active Directory global address list (GAL) 
     • In the name type GALSyncMA for Northwind.com
     • On the Connect to an Active Directory Forest page, type the forest name, the MIM MA account details (svc-mimadma@northwind.com) and the domain name
     • In the next screen, specify the OUs that GALSync will query to find mailboxes to create contacts for in the other forests. Also, place a tick beside northwind.com\GALSync (this selects GALSync and all sub-OUs)
     • In the Containers screen, for
       • Target Container select Northwind.com\GALSync\RemoteForest\Contactsthis is the OU where MIM GALSync will create contacts corresponding to the mailboxes in Contoso and WingTipToys Exchange Forest
       • Source Container select Northwind.com\GALSync\LocalForest\Contactsthis is where MIM GALSync will create contacts corresponding to Northwind.com mailboxes. These will be sent to the GALSync/RemoteForest/Contacts OU in Contoso and WingTipToys AD Domain (personally, I haven’t seen any objects created in this OU)
     • In Exchange Configuration click Edit and enter all the email suffixes that belong to Northwind.com. The email suffixes listed here are used to filter out which email addresses from the original email object are added to the corresponding contact in the other Exchange Forests. In this case the email suffixes will be @northwind.com and @northwind.com.au. Note the @ before the email suffix)
     • Leave everything else as default and proceed to the Configure Extensions section. One thing I would like to mention here is that in Configure Connection Filter section, the Filter Type for user is supposed to be Declared (and is the default setting), not Rules extension as stated in https://technet.microsoft.com/en-us/library/cc708642(v=ws.10).aspx
     • In the Configure Extensions section, set the following
       • Rules extension name: GALSync.dll (this should already be set)
       • Provision for: Exchange 2010
       • Exchange 2010 RPS URI: http://NWEX01.contoso.com/Powershell
     • Click OK
   • Create GALSync Management Agent for WingTipToys.com AD Forest
     • From Tools menu, click Management Agents and then click Create
     •  In the Management Agent drop-down list, click Active Directory global address list (GAL) 
     • In the name type GALSyncMA for WingTipToys.com
     • On the Connect to an Active Directory Forest page, type the forest name, the MIM MA account details (svc-mimadma@wingtiptoys.com) and the domain name
     • In the next screen, specify the OUs that GALSync will query to find mailboxes to create contacts for in the other forests. Also, place a tick beside wingtiptoys.com\GALSync (this selects GALSync and all sub-OUs)
     • In the Containers screen, for
       • Target Container select WingTipToys.com\GALSync\RemoteForest\Contactsthis is the OU where MIM GALSync will create contacts corresponding to the mailboxes in Contoso and Northwind Exchange Forest
       • Source Container select WIngTipToys.com\GALSync\LocalForest\Contactsthis is where MIM GALSync will create contacts corresponding to WingTipToys.com mailboxes. These will be sent to the GALSync/RemoteForest/Contacts OU in Contoso and Northwind AD Domain (personally, I haven’t seen any objects created in this OU)
     • In Exchange Configuration click Edit and enter all the email suffixes that belong to WingTipToys.com. The email suffixes listed here are used to filter out which email addresses from the original email object are added to the corresponding contact in the other Exchange Forests. In this case the email suffixes will be @wingtiptoys.com and @wingtiptoys.com.au. Note the @ before the email suffix)
     • Leave everything else as default and proceed to the Configure Extensions section. One thing I would like to mention here is that in Configure Connection Filter section, the Filter Type for user is supposed to be Declared (and is the default setting), not Rules extension as stated in https://technet.microsoft.com/en-us/library/cc708642(v=ws.10).aspx
     • In the Configure Extensions section, set the following
       • Rules extension name: GALSync.dll (this should already be set)
       • Provision for: Exchange 2010
       • Exchange 2010 RPS URI: http://WTTEX01.contoso.com/Powershell
     • Click OK
2. Enable provisioning by using the following steps
   • In the Synchronisation Service Manager, from Tools select Options
   • Under Metaverse Rules Extensions ensure the following have been ticked
     • Enable metaverse rules extensions
     • Enable Provisioning Rules Extension

Run Profiles Execution Order

Congratulations! All configuration has now been completed. All we have to do now is to run the synchronisation jobs to get the mailbox object information from the three AD Forests into the MIM metaverse, let MIM GALSync do a bit of processing to find out which contacts are to be created in the other Exchange Forests, and then carry out an export, to create those contacts in the other Exchange Forests. Unfortunately, MIM has no way of finding out if the exports were successful, and that is why we will have to do a confirming import on all the management agents, so that MIM can find out if everything had been exported as expected.
From my testing, I have found that when MIM GALSync does its processing, it compares the mailboxes that an Exchange Forest has with what is in the MIM metaverse. MIM then exports out, as contacts, all objects that are in the metaverse but not in that particular Exchange Forest. These are populated in that AD Domains GALSync/RemoteForest/Contacts OU as AD objects and subsequently mail enabled using the Exchange RPS URI (remote PowerShell url)
CAUTION! Before you continue, you need to find out if a synchronisation solution had previously been deployed in the environment.
If any of the AD Forests had previously had a synchronisation solution deployed, then we will need to follow the run profile execution order mentioned below. This is done to ensure no duplicate contacts are created during the initial GAL synchronisation.

1. Full Import (Staging Only) on GALSyncMA for Contoso.com
2. Full Import (Staging Only) on GALSyncMA for Northwind.com
3. Full Import (Staging Only) on GALSyncMA for WingTipToys.com
4. Delta Synchronisation on GALSyncMA for Contoso.com
5. Delta Synchronisation on GALSyncMA for Northwind.com
6. Delta Synchronisation on GALSyncMA for WingTipToys.com
7. Repeat Delta Synchronisation on GALSyncMA for Contoso.com
8. Repeat Delta Synchronisation on GALSyncMA for Northwind.com
9. Repeat Delta Synchronisation on GALSyncMA for WingTipToys.com
10. Export on GALSyncMA for Contoso.com
11. Export on GALSyncMA for Northwind.com
12. Export on GALSyncMA for WingTipToys.com
13. Delta Import on GALSyncMA for Contoso.com
14. Delta Import on GALSyncMA for Northwind.com
15. Delta Import on GALSyncMA for WingTipToys.com

 
If there hasn’t been any previous synchronisation solutions deployed in any of the AD Forests, then use the following runprofile order for the initial run

1. Full Import (Staging Only) on GALSyncMA for Contoso.com
2. Full Import (Staging Only) on GALSyncMA for Northwind.com
3. Full Import (Staging Only) on GALSyncMA for WingTipToys.com
4. Full Synchronisation on GALSyncMA for Contoso.com
5. Full Synchronisation on GALSyncMA for Northwind.com
6. Full Synchronisation on GALSyncMA for WingTipToys.com
7. Export on GALSyncMA for Contoso.com
8. Export on GALSyncMA for Northwind.com
9. Export on GALSyncMA for WingTipToys.com
10. Delta Import on GALSyncMA for Contoso.com
11. Delta Import on GALSyncMA for Northwind.com
12. Delta Import on GALSyncMA for WingTipToys.com

 
Once the initial synchronisation has completed, you will see contacts in each AD Domain’s GALSync\RemoteForest\Contacts OU corresponding to mailboxes in the other two Exchange Forests. These will have been email enabled and will show in the Exchange console and the online Global Address List.
Outlook clients that use offline address books won’t see the new contacts until the offline address book generation process has run on the Exchange servers and the updated offline address book has been downloaded by the outlook client.
To ensure the GALSync generated contacts remain up-to-date, the following runprofile execution order must be used from hereon. This should be repeated every 1 hour (or as per your required interval. Keep in mind that if after one cycle of the following order, if anything is still pending an Export, then this will be run at the next runprofile execution, so changes might not be seen for at most two runcycle intervals)

1. Delta Import (Staging Only) on GALSyncMA for Contoso.com
2. Delta Import (Staging Only) on GALSyncMA for Northwind.com
3. Delta Import (Staging Only) on GALSyncMA for WingTipToys.com
4. Delta Synchronisation on GALSyncMA for Contoso.com
5. Delta Synchronisation on GALSyncMA for Northwind.com
6. Delta Synchronisation on GALSyncMA for WingTipToys.com
7. Export on GALSyncMA for Contoso.com
8. Export on GALSyncMA for Northwind.com
9. Export on GALSyncMA for WingTipToys.com
10. Delta Import on GALSyncMA for Contoso.com
11. Delta Import on GALSyncMA for Northwind.com
12. Delta Import on GALSyncMA for WingTipToys.com

I don’t imagine anyone would want to run the runprofiles manually every hour 😉 So below is a script that can be used to do it.
Export all the runprofiles using the Synchronisation Service Manager as vbs scripts and place them in a folder c:\scripts\runprofiles on the MIM Synchronisation Server.
Copy the below script and save it as GALSync_RunProfiles.cmd in c:\scripts

@echo off
REM This script will run the MIM RunProfiles in the correct order
REM Author nivleshc@yahoo.com
set _script_dir="c:\scripts\runprofiles\"
REM Delta Import (Stage Only)
echo ContosoGALSyncMA Delta Import -StageOnly
CSCRIPT //B %_script_dir%ContosoGALSyncMA_Delta_Import_StageOnly.vbs
echo NorthwindGALSyncMA Delta Import -StageOnly
CSCRIPT //B %_script_dir%NorthwindGALSyncMA_Delta_Import_StageOnly.vbs
echo WingTipToysGAlSyncMA Delta Import -StageOnly
CSCRIPT //B %_script_dir%WingTipToysGAlSyncMA_Delta_Import_StageOnly.vbs
REM Delta Sync
echo ContosoGALSyncMA Delta Sync
CSCRIPT //B %_script_dir%ContosoGALSyncMA_Delta_Sync.vbs
echo NorthwindGALSyncMA Delta Sync
CSCRIPT //B %_script_dir%NorthwindGALSyncMA_Delta_Sync.vbs
echo WingTipToysGAlSyncMA Delta Sync
CSCRIPT //B %_script_dir%WingTipToysGAlSyncMA_Delta_Sync.vbs
REM Export
echo ContosoGALSyncMA Export
CSCRIPT //B %_script_dir%ContosoGALSyncMA_Export.vbs
echo NorthwindGALSyncMA Export
CSCRIPT //B %_script_dir%NorthwindGALSyncMA_Export.vbs
echo WingTipToysGAlSyncMA Export
CSCRIPT //B %_script_dir%WingTipToysGAlSyncMA_Export.vbs
REM Delta Import
echo ContosoGALSyncMA Delta Import
CSCRIPT //B %_script_dir%ContosoGALSyncMA_Delta_Import.vbs
echo NorthwindGALSyncMA Delta Import
CSCRIPT //B %_script_dir%NorthwindGALSyncMA_Delta_Import.vbs
echo WingTipToysGAlSyncMA Delta Import
CSCRIPT //B %_script_dir%WingTipToysGAlSyncMA_Delta_Import.vbs

 
Create a scheduled task on the MIM Synchronisation Server to run GALSync_RunProfiles.cmd script every 1 hour (or for an interval of your choice). Use the task scheduler account that had been created during the preparation stage to run this scheduled task.

Some Gotchas

I have found that sometimes some mailboxes fail to be imported into the MIM Metaverse and report an mv-constraing-restriction violation on the msExchSafeSenderHash attribute. This error occurs because the AD attribute msExchSafeSenderHash is much longer than what the corresponding MIM Metaverse attribute is. Since this attribute is not being used to create the contacts in the other Exchange Forests, it can be dropped from the attribute flow.
Use the steps outlined in the following article to resolve this issue. https://social.technet.microsoft.com/wiki/contents/articles/10733.troubleshooting-galsync-mv-constraint-violation-msexchsafesenderhash.aspx
 
I hope this blog helps those that might be wanting to create a shared “global address book” among multiple Exchange Forests.
As mentioned previous, the above steps can be used to create a  shared “global address book” for two Exchange Forests as well. In that case, just remove any mention of the third AD Forest, AD Domain and Exchange Forest from the above mentioned steps.
Enjoy 😉