Prepare mailboxes for cross-forest move requests in Exchange Server

Mailbox moves and mailbox migrations in Exchange 2016 and Exchange 2019 from one forest to another require that you prepare the destination forest, which is made easier by Exchange tools and cmdlets. Exchange 2016 supports mailbox moves and migrations using the Exchange Management Shell, specifically the New-MoveRequest and New-MigrationBatch cmdlets. You can also move the mailbox in the Exchange admin center (EAC).

To move an Exchange mailbox from a source forest to the target Exchange 2016 or Exchange 2019 target forest, the target forest needs to contain a valid mail user (also known as a mail-enabled user) with a specified set of Active Directory attributes.

• In Exchange 2016, you can move an Exchange 2010, Exchange 2013, or Exchange 2016 mailbox from a source Exchange forest to a target Exchange 2016 forest. If there's at least one Exchange 2016 Mailbox server in the target forest, the forest is considered an Exchange 2016 forest.

• In Exchange 2019, you can move an Exchange 2013, Exchange 2016, or Exchange 2019 mailbox from a source Exchange forest to a target Exchange 2019 forest. If there's at least one Exchange 2019 Mailbox server in the target forest, the forest is considered an Exchange 2019 forest.

To prepare for the mailbox move, you need to create mail users (also known as mail-enabled users) with the required Active Directory attributes in the target forest. There are two recommended approaches for creating mail users with the necessary attributes:

• If you deployed Identity Lifecycle Manager (ILM) for cross-forest global address list (GAL) synchronization, we recommend that you use Microsoft Identity Manager 2016 Service Pack 1. We've created sample code that you can use to learn how to customize ILM to synchronize the source mailbox user and target mail user.

  For more information, including how to download the sample code, see Prepare mailboxes for cross-forest moves using sample code.

• If you created the target mail user using an Active Directory tool other than ILM or Microsoft Identity Integration Server (MIIS), use the Update-Recipient cmdlet with the Identity parameter to generate the LegacyExchangeDN attribute for the target mail user. We've created a sample PowerShell script that reads from and writes to Active Directory and calls the Update-Recipient cmdlet.

  For more information about using the sample script, see Prepare mailboxes for cross-forest moves using the Exchange Management Shell.

After creating the target mail user, you can then run the New-MoveRequest or the New-MigrationBatch cmdlets to move the mailbox to the target Exchange 2016 or Exchange 2019 forest.

For more information about remote move requests, see the following topics:

• New-MigrationBatch

• New-MoveRequest

The remainder of this topic describes the mail user Active Directory attributes that are required for a mailbox move. These attributes are configured for you when you use either the code or the script to prepare for the mailbox move. However, you can manually copy these attributes using an Active Directory editor.

Active Directory user attributes required for a mailbox move

To support a remote mailbox move, the mail user object in the target Exchange forest must have the Active Directory attributes that are described in this section:

• Mandatory attributes

• Optional attributes

• Linked attributes

• Linked user attributes

• Resource mailbox attributes

• Additional attributes

Mandatory attributes

The following table lists the minimum set of attributes that need to be configured in ILM on the target mail user for the New-MoveRequest cmdlet to function correctly.

Mail user attributes

Optional attributes

The following attributes aren't required for the New-MoveRequest cmdlet to function correctly; however, synchronizing them provides a better end-to-end user experience after moving the mailbox. Because the GAL in the target forest displays this target mail user, you should set the following GAL-related attributes.

GAL-related attributes

Linked attributes

A linked attribute is an Active Directory attribute that references other Active Directory objects in the local forest. You can't directly copy the linked attribute values from a mailbox in the source forest to a mail user in the target forest. Instead, you do the following steps:

1. Find the Active Directory objects in the source forest that the source mailbox attribute refers to.

2. Find the corresponding Active Directory objects in the target forest.

3. Set the target mail user's attribute to refer to the Active Directory objects in the target forest.

Linked attributes

Linked user attributes

If you want to move a mailbox to an Exchange resource forest, the mailbox in the resource forest is considered a linked mailbox. In this scenario, you need to create a linked mail user in the (target) resource forest. To create a linked mail user, you need to set the attributes shown in the following table.

Linked mail user attributes

If the source object is disabled and the msExchMasterAccountSid attribute is set to self (resource mailbox, shared mailbox), don't stamp anything on the target user.

If the source object is disabled and the msExchMasterAccountSid attribute isn't set, the mailbox is invalid.

If the source object is enabled and the msExchMasterAccountSid attribute is set, the mailbox is invalid.

Resource mailbox attributes

If you want to move a resource mailbox to an Exchange forest, you need to set the attributes shown in the following table on the target mail user.

Resource mailbox attributes

Additional attributes

Resource mailbox attributes