If you are in a classic cross-forest scenario, you have Exchange installed in both Forest A and Forest B, and if you do not want the user in Forest A who will administer Exchange in Forest B to also be an administrator in Forest A, you must rename, move to a different organizational unit, or move to a different domain the following organizational unit and groups in Forest A:

• Microsoft Exchange Security Groups
  
  
• Exchange Organization Administrators
  
  
• Exchange Public Folder Administrators
  
  
• Exchange Recipient Administrators
  
  
• Exchange View-Only Administrators
  
  

After you rename or move these groups, they will still have the same membership and permissions, and you will still be able to administer Exchange in Forest A by using accounts that are members of these groups.

If you are in a classic cross-forest scenario, you have Exchange installed in both Forest A and Forest B, and you want the user in Forest A to administer Exchange in both Forest A and Forest B, continue to Step 9.

If you are in a resource forest scenario, continue to Step 2.

In the root domain of Forest A, create a new organizational unit called Microsoft Exchange Security Groups. For more information about creating an organizational unit, see Create a New Organizational Unit.

In the Microsoft Exchange Security Groups organizational unit in Forest A, create the following universal security groups:

• Exchange Organization Administrators
  
  
• Exchange Public Folder Administrators
  
  
• Exchange Recipient Administrators
  
  
• Exchange View-Only Administrators
  
  

For more information, see Create a new group.

Note:
Be sure to select Universal for the group scope and Security for the group type.

In Forest A, perform the following steps to add the Exchange Organization Administrators group to the Exchange Recipient Administrators group:

1. Right-click the Exchange Recipient Administrators group, and then click Properties.
   
   
2. On the Members tab, click Add.
   
   
3. In Select Users, Computers, or Groups, type Exchange Organization Administrators, and then click OK.
   
   
4. Click OK on the Exchange Recipient Administrators Properties page.
   
   

In Forest A, perform the following steps to add the Exchange Organization Administrators group to the Exchange Public Folder Administrators group:

1. Right-click the Exchange Public Folders Administrators group, and then click Properties.
   
   
2. On the Members tab, click Add.
   
   
3. In Select Users, Computers, or Groups, type Exchange Organization Administrators, and then click OK.
   
   
4. Click OK on the Exchange Public Folder Administrators Properties page.
   
   

In Forest A, perform the following steps to add the Exchange Recipient Administrators group to the Exchange View-Only Administrators group:

1. Right-click the Exchange View-Only Administrators group, and then click Properties.
   
   
2. On the Members tab, click Add.
   
   
3. In Select Users, Computers, or Groups, type Exchange Recipient Administrators, and then click OK.
   
   
4. Click OK on the Exchange View-Only Administrators Properties page.
   
   

In Forest A, perform the following steps to add the Exchange Public Folder Administrators group to the Exchange View-Only Administrators group:

1. Right-click the Exchange View-Only Administrators group, and then click Properties.
   
   
2. On the Members tab, click Add.
   
   
3. In Select Users, Computers, or Groups, type Exchange Public Folder Administrators, and then click OK.
   
   
4. Click OK on the Exchange View-Only Administrators Properties page.
   
   

In Active Directory Users and Computers in Forest A, on the View menu, click Advanced Features, and then follow these steps:

1. Right-click the Microsoft Exchange Security Groups organizational unit, and then click Properties.
   
   
2. On the Security tab, click Advanced.
   
   
3. On the Permissions tab, select Exchange Organization Administrators in the Permission entries list, and then click Edit.
   
   
4. On the Object tab, in the Apply to list, select This object and all child objects.
   
   
5. In the Permissions list, locate Full Control, and then click to select the Allow check box.
   
   
6. Click OK.
   
   
7. On the Permissions tab, select Exchange Recipient Administrators, and then click Edit.
   
   
8. On the Object tab, in the Apply to list, select This object and all child objects.
   
   
9. In the Permissions list, locate Full Control, and then click to select the Allow check box.
   
   
10. Click OK.
    
    
11. On the Permissions tab, select Exchange Public Folder Administrators, and then click Edit.
    
    
12. On the Object tab, in the Apply to list, select This object and all child objects.
    
    
13. In the Permissions list, locate Full Control, and then click to select the Allow check box.
    
    
14. Click OK.
    
    
15. On the Permissions tab, select Exchange View-Only Administrators, and then click Edit.
    
    
16. On the Object tab, in the Apply to list, select This object and all child objects.
    
    
17. In the Permissions list, locate Full Control, and then click to select the Allow check box.
    
    
18. Click OK two times.
    
    

Log on to Forest B by using an account that is a member of the Enterprise Admins group in Forest B, and then run the following command from a Command Prompt window:

	Copy Code
Setup /prepareAD /ForeignForestFQDN:ForestA.contoso.com

This command verifies that the Exchange universal security groups in Forest A are created and that permissions are assigned correctly. In Forest B, the command configures access control entries (ACEs) in Active Directory on the Exchange configuration objects so that the newly created Exchange universal security groups in Forest A have rights to the Exchange configuration in Forest B. When you run Setup /PrepareAD without the ForeignForestFQDN parameter, the command creates the Exchange universal security groups in the local forest and sets permissions on these groups. Adding the ForeignForestFQDN parameter specifies that you want to give the Exchange universal security groups in a foreign forest permission to the Exchange configuration in the forest where you run the command.

To verify that Setup completed successfully, perform the following steps:

1. In Forest B, right-click the Exchange Servers universal security group, and then click Properties.
   
   
2. On the Security tab, under Group or user names, select Exchange Organization Administrators (<Forest A domain\Exchange Organization Administrators>).
   
   
3. Verify that Allow is selected for the Full Control permission.
   
   

Note:
If Setup fails because of insufficient access rights, verify that you created the universal security groups correctly in Forest A, that the groups are nested correctly, and that the Exchange Organization Administrators group has full control of the new organizational unit and all three new universal security groups, and then perform Step 9 again.

To administer Exchange in Forest B by using an account in Forest A, add the account in Forest A to one or more of the Exchange universal security groups that you created in Forest A.

(Optional) Change the trust from a two-way to a one-way forest trust. To do this, delete the existing two-way incoming trust with Forest A. For detailed steps, see Remove a manually created trust.

Note:
Be sure to select Yes, remove the trust from both the local domain and the other domain.

Note:
You must retain the outgoing trust.

In Active Directory Users and Computers in Forest B, on the View menu, click Advanced Features.

(Optional) If you want recipient administrators in Forest A to administer users in Forest B, you must manually assign them permissions. Perform the following steps:

1. In Active Directory Users and Computers in Forest B, right-click the Users container, and then click Properties. 
   
   
2. On the Security tab, click Advanced.
   
   
3. Under Permissions entries, select the entry where Type is Allow, Name is Exchange Recipient Administrators (<Forest A domain\Exchange Recipient Administrators>), and Permission is Special, and then click Edit.
   
   
4. On the Permission Entry for Users page, on the Objects tab under Permissions, select Allow for the following permissions: List Contents, Read All Properties, Write All Properties, Read Permissions, Create User Objects, Delete User Objects.
   
   
5. Click OK.
   
   
6. On the Advanced Security Settings for Users page, select the Allow inheritable permissions from the parent to propagate to this object and all child objects check box, and then click OK.
   
   

Note:

This step provides the permissions necessary for members of the Exchange Recipient Administrators group in Forest A to modify objects in the User container in Forest B. Running Setup /ForeignForestFQDN in Forest B (in Step 9) granted users in the Exchange security groups in Forest A permission to Exchange properties in Forest B, but not to Windows user properties in Forest B.  To provide permissions to other groups in Forest A so they can modify objects in the User container in Forest B, select a different group on the Advanced Security Settings for Users page.

(Optional) If you want administrators in Forest A to have permission to use the Exchange Management Console and the Exchange Management Shell on an Exchange server in Forest B, you must manually grant permissions on the Bin, Public, and Scripts directories in the Exchange Server directory to the user. Perform the following steps:

1. Navigate to the Exchange Server directory where Exchange is installed. (By default the directory is %programfiles%\Microsoft\Exchange Server.)
   
   
2. Right-click the Bin directory, and then click Properties.
   
   
3. On the Security tab, click Add, and then enter the user or group to which you want to give permission.
   
   
4. Under Permissions for <user or group>, select Allow for the Read & Execute permission, and then click OK.
   
   
5. Right-click the Public directory, and then click Properties.
   
   
6. On the Security tab, click Add, and then enter the user or group to which you want to give permission.
   
   
7. Under Permissions for <user or group>, select Allow for the Read & Execute permission, and then click OK.
   
   
8. Right-click the Scripts directory, and then click Properties.
   
   
9. On the Security tab, click Add, and then enter the user or group to which you want to give permission.
   
   
10. Under Permissions for <user or group>, select Allow for the Read & Execute permission, and then click OK.
    
    

Note:

To administer Exchange in Forest B, users in Forest A must also be able to log on to a server in Forest B that has Exchange or the Exchange management tools installed. If you add users in Forest A to the Domain Admins group or to the local Administrators group on the server in Forest B so that they can log on to a server in Forest B, they will already have Read & Execute permissions on the Bin, Public, and Scripts directories. Alternatively, you can give users in Forest A specific permissions to log on to a server remotely by using the Terminal Services component of Windows Server 2003.

If you are in a classic cross-forest scenario, you have Exchange installed in both Forest A and Forest B, and if you do not want the user in Forest A who will administer Exchange in Forest B to also be an administrator in Forest A, you must rename, move to a different organizational unit, or move to a different domain the following organizational unit and groups in Forest A:

• Microsoft Exchange Security Groups
  
  
• Exchange Organization Administrators
  
  
• Exchange Recipient Administrators
  
  
• Exchange View-Only Administrators
  
  

After you rename or move these groups, they will still have the same membership and permissions, and you will still be able to administer Exchange in Forest A by using accounts that are members of these groups.

If you are in a classic cross-forest scenario, you have Exchange installed in both Forest A and Forest B, and you want the user in Forest A to administer Exchange in both Forest A and Forest B, continue to Step 7.

If you are in a resource forest scenario, continue to Step 2.

In the root domain of Forest A, create a new organizational unit called Microsoft Exchange Security Groups. For more information about creating an organizational unit, see Create a New Organizational Unit.

In the Microsoft Exchange Security Groups organizational unit in Forest A, create the following universal security groups:

• Exchange Organization Administrators
  
  
• Exchange Recipient Administrators
  
  
• Exchange View-Only Administrators
  
  

For more information, see Create a new group.

Note:
Be sure to select Universal for the group scope and Security for the group type.

In Forest A, perform the following steps to add the Exchange Organization Administrators group to the Exchange Recipient Administrators group:

1. Right-click the Exchange Recipient Administrators group, and then click Properties.
   
   
2. On the Members tab, click Add.
   
   
3. In Select Users, Computers, or Groups, type Exchange Organization Administrators, and then click OK.
   
   
4. Click OK on the Exchange Recipient Administrators Properties page.
   
   

In Forest A, perform the following steps to add the Exchange Recipient Administrators group to the Exchange View-Only Administrators group:

1. Right-click the Exchange View-Only Administrators group, and then click Properties.
   
   
2. On the Members tab, click Add.
   
   
3. In Select Users, Computers, or Groups, type Exchange Recipient Administrators, and then click OK.
   
   
4. Click OK on the Exchange View-Only Administrators Properties page.
   
   

In Active Directory Users and Computers in Forest A, on the View menu, click Advanced Features, and then perform the following steps:

1. Right-click the Microsoft Exchange Security Groups organizational unit, and then click Properties.
   
   
2. On the Security tab, under Group or user names, select Exchange Organization Administrators.
   
   
3. Under Permissions for Exchange Organization Administrators, select Full Control, and then click OK.
   
   
4. Right-click the Exchange Organization Administrators group, and then click Properties.
   
   
5. On the Security tab, under Group or user names, select Exchange Organization Administrators.
   
   
6. Under Permissions for Exchange Organization Administrators, select Full Control, and then click OK.
   
   
7. Right-click the Exchange Recipient Administrators group, and then click Properties.
   
   
8. On the Security tab, under Group or user names, select Exchange Organization Administrators.
   
   
9. Under Permissions for Exchange Organization Administrators, select Full Control, and then click OK.
   
   
10. Right-click the Exchange View-Only Administrators group, and then click Properties.
    
    
11. On the Security tab, under Group or user names, select Exchange Organization Administrators.
    
    
12. Under Permissions for Exchange Organization Administrators, select Full Control, and then click OK.
    
    

Log on to Forest B by using an account that is a member of the Enterprise Admins group in Forest B, and then run the following command from a Command Prompt window:

	Copy Code
Setup /prepareAD /ForeignForestFQDN:ForestA.contoso.com

This command verifies that the Exchange universal security groups in Forest A are created and that permissions are assigned correctly. In Forest B, the command configures access control entries (ACEs) in Active Directory on the Exchange configuration objects so that the newly created Exchange universal security groups in Forest A have rights to the Exchange configuration in Forest B. When you run Setup /PrepareAD without the ForeignForestFQDN parameter, the command creates the Exchange universal security groups in the local forest and sets permissions on these groups. Adding the ForeignForestFQDN parameter specifies that you want to give the Exchange universal security groups in a foreign forest permission to the Exchange configuration in the forest where you run the command.

To verify that Setup completed successfully, perform the following steps:

1. In Forest B, right-click the Exchange Servers universal security group, and then click Properties.
   
   
2. On the Security tab, under Group or user names, select Exchange Organization Administrators (<Forest A domain\Exchange Organization Administrators>).
   
   
3. Verify that Allow is selected for the Full Control permission.
   
   

Note:
If Setup fails because of insufficient access rights, verify that you created the universal security groups correctly in Forest A, that the groups are nested correctly, and that the Exchange Organization Administrators group has full control of the new organizational unit and all three new universal security groups, and then perform Step 7 again.

To administer Exchange in Forest B by using an account in Forest A, add the account in Forest A to one or more of the Exchange universal security groups that you created in Forest A.

(Optional) Change the trust from a two-way to a one-way forest trust. To do this, delete the existing two-way incoming trust with Forest A. For detailed steps, see Remove a manually created trust.

Note:
Be sure to select Yes, remove the trust from both the local domain and the other domain.

Note:
You must retain the outgoing trust.

In Active Directory Users and Computers in Forest B, on the View menu, click Advanced Features.

(Optional) If you want recipient administrators in Forest A to administer users in Forest B, you must manually assign them permissions. Perform the following steps:

1. In Active Directory Users and Computers in Forest B, right-click the Users container, and then click Properties. 
   
   
2. On the Security tab, click Advanced.
   
   
3. Under Permissions entries, select the entry where Type is Allow, Name is Exchange Recipient Administrators (<Forest A domain\Exchange Recipient Administrators>), and Permission is Special, and then click Edit.
   
   
4. On the Permission Entry for Users page, on the Objects tab under Permissions, select Allow for the following permissions: List Contents, Read All Properties, Write All Properties, Read Permissions, Create User Objects, Delete User Objects.
   
   
5. Click OK.
   
   
6. On the Advanced Security Settings for Users page, select the Allow inheritable permissions from the parent to propagate to this object and all child objects check box, and then click OK.
   
   

Note:

This step provides the permissions necessary for members of the Exchange Recipient Administrators group in Forest A to modify objects in the User container in Forest B. Running Setup /ForeignForestFQDN in Forest B (in Step 7) granted users in the Exchange security groups in Forest A permission to Exchange properties in Forest B, but not to Windows user properties in Forest B.  To provide permissions to other groups in Forest A so they can modify objects in the User container in Forest B, select a different group on the Advanced Security Settings for Users page.

(Optional) If you want administrators in Forest A to have permission to use the Exchange Management Console and the Exchange Management Shell on an Exchange server in Forest B, you must manually grant permissions on the Bin, Public, and Scripts directories in the Exchange Server directory to the user. Perform the following steps:

1. Navigate to the Exchange Server directory where Exchange is installed. (By default the directory is %programfiles%\Microsoft\Exchange Server.)
   
   
2. Right-click the Bin directory, and then click Properties.
   
   
3. On the Security tab, click Add, and then enter the user or group to which you want to give permission.
   
   
4. Under Permissions for <user or group>, select Allow for the Read & Execute permission, and then click OK.
   
   
5. Right-click the Public directory, and then click Properties.
   
   
6. On the Security tab, click Add, and then enter the user or group to which you want to give permission.
   
   
7. Under Permissions for <user or group>, select Allow for the Read & Execute permission, and then click OK.
   
   
8. Right-click the Scripts directory, and then click Properties.
   
   
9. On the Security tab, click Add, and then enter the user or group to which you want to give permission.
   
   
10. Under Permissions for <user or group>, select Allow for the Read & Execute permission, and then click OK.
    
    

Note:

To administer Exchange in Forest B, users in Forest A must also be able to log on to a server in Forest B that has Exchange or the Exchange management tools installed. If you add users in Forest A to the Domain Admins group or to the local Administrators group on the server in Forest B so that they can log on to a server in Forest B, they will already have Read & Execute permissions on the Bin, Public, and Scripts directories. Alternatively, you can give users in Forest A specific permissions to log on to a server remotely by using the Terminal Services component of Windows Server 2003.