Share via

Upgrade from Exchange 2003 Client Access

  • Article

When you're upgrading your existing Microsoft Exchange Server 2003 organization to Exchange Server 2010, there's a period of time when both Exchange 2003 and Exchange 2010 will coexist within your organization. This topic describes the various steps you must take to upgrade an Exchange 2003 organization to Exchange 2010.

Important

When you upgrade your organization to Exchange 2010, your clients running Outlook 2003 don’t use RPC encryption, which RPC Client Access requires by default. You will either need to turn off the RPC encryption requirement or configure Outlook 2003 to use RPC encryption. However, Outlook 2007 and later versions are automatically compatible with the change to RPC Client Access because they support RPC encryption by default.
For more information, see: Understanding RPC Client Access.

Overview of the Upgrade Process

The upgrade process includes the following steps:

  1. Installing Exchange 2010 within your organization on new hardware.

  2. Configuring Exchange 2010 Client Access.

  3. Creating a set of legacy host names and associating those host names with your Exchange 2003 infrastructure.

    Note

    Your legacy host name should be in the format "legacy.contoso.com", where contoso.com matches your current host name.

    Note

    Configuring a legacy host name is necessary only if you'll need Exchange 2003 and Exchange 2010 to coexist in the same organization. If you have a small number of mailboxes and can move all your mailboxes from Exchange 2003 to Exchange 2010 during the downtime you've scheduled for the upgrade, this step isn't necessary.

  4. Obtaining a digital certificate with the names you'll be using during the coexistence period and installing it on your Exchange 2010 Client Access server.

  5. Associating the host name you currently use for your Exchange 2003 infrastructure with your newly-installed Exchange 2010 infrastructure.

  6. Moving mailboxes from Exchange 2003 to Exchange 2010.

  7. Decommissioning your Exchange 2003 infrastructure.

Note

Throughout this topic, mail.contoso.com will be used as the primary namespace and legacy.contoso.com will be used as the legacy namespace. When you perform your upgrade you'll substitute the names of your own primary and legacy namespaces.

Understanding Legacy Host Names

An important part of the upgrade process is configuring a legacy host name and associating that host name with your Exchange 2003 infrastructure. This is a necessary step if your organization has a significant number of mailboxes that can't all be moved from Exchange 2003 to Exchange 2010 during the downtime scheduled for the upgrade and if your organization supports Outlook Web Access for Internet users.

If your organization has a small number of mailboxes, and you're able to schedule downtime over an evening or a weekend, you can skip the step of configuring a legacy host name and move all mailboxes during this downtime. Doing this eliminates the need for Exchange 2003 and Exchange 2010 to coexist.

You'll have to configure a legacy host name to be published to the Internet and associated with the virtual directories of the various services you have on Exchange 2003, such as Microsoft Exchange ActiveSync, Microsoft Outlook Web Access, POP3, and IMAP4 if:

  • You have a significant number of mailboxes to move from Exchange 2003 to Exchange 2010
    or
  • You don't want to move all mailboxes at once
    and
  • You have users who access Outlook Web Access from the Internet.

After a legacy host name has been configured and associated with your Exchange 2003 infrastructure, and your current host name has been associated with your Exchange 2010 infrastructure, users will experience a seamless transition. Exchange 2010 will redirect users from the Exchange 2010 Client Access server to the Exchange 2003 front-end server. Users won't have to learn a new URL to access Outlook Web Access (called Outlook Web App in Exchange 2010) or reconfigure their Exchange ActiveSync devices. POP3, IMAP4, and Outlook Anywhere users can also continue to access their mailboxes without interruption.

Certificate Planning for Upgrade

To support coexistence of Exchange 2003 and Exchange 2010, you'll likely have to obtain a new commercial certificate. We recommend that you obtain a certificate that supports Subject Alternative Names. However, a wildcard certificate is also supported. For more information about certificates, see Understanding Digital Certificates and SSL.

Return to top

Installing Exchange 2010

After you've ensured that the prerequisites are met and you've obtained the correct certificates, you can begin your upgrade. Do this using the following steps.

Note

In the following steps, replace <CAS2010> with the name of your Exchange 2010 Client Access server.

  1. Install the Exchange 2010 Client Access server role.

  2. During Setup, you can enter the primary external namespace for your virtual directories. This value should be the primary host name that your users use to connect to Exchange services from the Internet, for example: mail.contoso.com.

    • If you're upgrading through the graphical user interface Setup experience, you'll be prompted to configure an external Client Access domain.
    • If you're upgrading from a command prompt, use the setup property /ExternalCASServerDomain and specify your domain, for example: mail.contoso.com.

  3. If your organization requires Outlook Anywhere access, enable Outlook Anywhere.

    • This can be done using the following command: Enable-OutlookAnywhere -Server:<CAS2010> -ExternalHostName:mail.contoso.com -SSLOffloading $false

  4. If you didn't configure a primary external namespace during setup, you'll have to run the following commands to configure the virtual directories for the Offline Address Book, Exchange Web Services, Exchange ActiveSync, Outlook Web App, and Exchange Control Panel. You can do that with the following commands:

    1. Offline Address Book: Set-OABVirtualDirectory <CAS2010>\OAB* -ExternalURL https://mail.contoso.com/OAB
    2. Web Services: Set-WebServicesVirtualDirectory <CAS2010>\EWS* -ExternalURL https://mail.contoso.com/ews/exchange.asmx
    3. Exchange ActiveSync: Set-ActiveSyncVirtualDirectory -Identity <CAS2010>\Microsoft-Server-ActiveSync -ExternalURL https://mail.contoso.com
    4. Outlook Web App:Set-OWAVirtualDirectory <CAS2010>\OWA* -ExternalURL https://mail.contoso.com/OWA
    5. Exchange Control Panel: Set-ECPVirtualDirectory <CAS2010>\ECP* -ExternalURL https://mail.contoso.com/ECP

  5. Configure the Exchange 2003 URL property on the /owa virtual directory. This is necessary for Exchange 2003 and Exchange 2010 to coexist. To configure this property, use the following command.

    • Set-OWAVirtualDirectory <CAS2010>\OWA* -Exchange2003URL https://legacy.contoso.com/exchange

    Note

    You must enable forms-based authentication on the Exchange 2003 front-end server to allow your users to access their mailboxes through a single sign-on during the coexistence period.

  6. Change the Offline Address Book generation server and enable web distribution on the Exchange 2010 Client Access server using the following steps:

    1. Move the Offline Address Book using the following command: Move-OfflineAddressBook "Default Offline Address List" -Server <MBX2010>
    2. Add the Exchange 2010 Client Access server as a web distribution point using the following commands:
    • $OABVDir=Get-OABVirtualDirectory -Server <CAS2010>
    • $OAB=Get-OfflineAddressBook "Default Offline Address List"
    • $OAB.VirtualDirectories and $OABVdir.DistinguishedName = Set-OfflineAddressBook "Default Offline Address List" -VirtualDirectories $OAB.VirtualDirectories

  7. Enable Integrated Windows authentication on the Microsoft-Server-ActiveSync virtual directory on the Exchange 2003 back-end server. This allows the Exchange 2010 Client Access server and the Exchange 2003 back-end server to communicate using Kerberos authentication.

    1. Install the hotfix located here, and then use Exchange System Manager to adjust the authentication settings of the Exchange ActiveSync virtual directory.

    2. Or, set the msExchAuthenticationFlags attribute to a value of 6 on the Microsoft-Server-ActiveSync object within the configuration container on each Exchange 2003 mailbox server. An example script is provided here.

      Important

      Don't use IIS Manager to change the authentication setting on the ActiveSync virtual directory, because the DS2MB process within the System Attendant will overwrite the settings that are stored in Active Directory.

  8. Create a legacy host name in your external DNS infrastructure and associate this host name with your Exchange 2003 front-end server or with your proxy infrastructure.

  9. Reconfigure your External DNS settings or the publishing rules for your reverse proxy infrastructure to have your original namespace of mail.contoso.com point to your Exchange 2010 Client Access server or Client Access server array.

  10. Test all client connections and re-enable Internet protocol client usage.