The Issue
Recently, I had to migrate/move users from E2003 to E2010 cross-forest. FIM took care of the basic user objects (MEU’s) in the new forest, so I developed the following. It would seem that this process, while hinted at in various websites, blogs, and articles, was always sort of vague – and in my case the permissions referenced were not enough to complete the tasks. The source object modifications failed. As I was doing the moves with a domain admin/org admin in the target, I had no issues there.
The Solution
csv format
# remember to not have a trailing line feed after the last entry
# - it causes the script to loop on a blank line
# - you can also remove the database field and e2010 will distribute mailboxes automatically among the available databases
---
identity,database
%m@domain.com,databasename
%m@domain.com,databasename
---
Perms needed
# The various texts indicate much less perms (recipient admin and local admin to the server) than I show here.
# These work much better!
Target: Domain Admin and Exchange Org Administrator
Source: Domain Admin and e2003 Full Admin
--- script follows ---
$SourceCredentials = Get-Credential
$TargetCredentials = Get-Credential
set-location "D:\program files\microsoft\exchange server\v14\Scripts"
import-csv d:\migrationcsvfiles\testusers.csv | foreach {.\Prepare-MoveRequest.ps1 -Identity $_.identity -RemoteForestDomainController whateveritis.domain.com -RemoteForestCredential $sourceCredentials -LocalForestDomainController whateveritis.domain.com -LocalForestCredential $targetCredentials -UseLocalObject}
# I noticed some random AD GUID errors when running both lines at once, so I started the top four lines, then did not copy in the line return after the new-moverequest and things stop erroring. YMMV.
import-csv d:\migrationcsvfiles\testusers.csv | foreach {New-MoveRequest -Identity $_.identity -RemoteLegacy -TargetDatabase $_.database -RemoteGlobalCatalog whateveritis.domain.com -RemoteCredential $sourceCredentials -DomainController whateveritis.domain.com -TargetDeliveryDomain "domain.com"}
---
).
