UPN Rename to another federated domain

1. We cannot rename the UPN of a user when user account is moving from one federated domain to another (such as john@contoso1.com to john@contoso2.com)
2. We can rename UPN of a user when user account is moving from one federated domain to a standard (non-federated) domain (such as john@contoso1.com to john@contosofoo.com)
3. Directory Sync cannot be used to rename a UPN from a federated domain to a managed domain because of a defect. A fix is in the works but not yet available.
4. The Office 365 Portal GUI cannot be used to rename a UPN from a federated domain to a managed domain because the object is DirSync’d and the GUI will not allow you to modify DirSync’d objects. Microsoft Online Services Module for Windows Powershell can be used to rename a user’s UPN in Office 365.

Therefore for us to provide customers with UPN rename functionality we will have to engineer some sort of the provisioning process that will provide two-step rename via a standard (non-federated domain). The steps below illustrate such process with a use-case scenario with the fictitious company Contoso. We will assume that Contoso has a default standard (non-federated) domain of contoso.onmicrosoft.com and contoso1.com and contoso2.com both of which are federated domains, and that Contoso is running Directory Sync:

1. John, who is working in Contoso’s Subsidiary, Contoso1, currently has his UPN set to John@contoso1.com. Contoso1.com is a Federated domain.
2. John is moving into his new role in Contoso’s Subsidiary, Contoso2; therefore his UPN should be changed to John@contoso2.com. Contoso2.com is a Federated domain.
3. We will rename John’s Office 365 UPN to a federated domain via Microsoft Online Services Module for Windows PowerShell using the command: set-msoluserprincipalname – UserPrincipalName john@contoso1.com -new UserPrincipalName john@contoso.onmicrosoft.com
4. John’s mailbox will be preserved, but a new password for John’s managed account needs to be established if they need to access the resources immediately, if not this can be skipped.
5. The on-premises AD administrator will now need to modify John’s account with the new john@contoso2.com UPN.
6. Force Directory Sync to propagate the change to Office 365 (or wait up to 3 hours).
   1. Directory Sync will update the value into the cloud and successfully move John’s account back to federated account, from the contoso.onmicrosoft.com standard domain. John’s mailbox is again preserved and John will be able to access his mailbox with new UPN and AD password.

My group in particular is focused right now on something we call Migration Due Diligence (MDD).  We are attempting to capture all the things we have learned while deploying early adopter and beta customers and create guidance on what it will take for a new customer to get to the cloud.  As you can imagine, this can be complex especially with things like ADFS and Hybrid (the term formally known as Rich Coexistence) as well as differences between customer environments.  We hope to eventually bring our evaluation tools to the web so that small to large customers can run them and decide how hard it might be for them to get to the cloud.

I am actively involved in many ongoing deployments for big customers and I hope to continue to post suggestions and pointers on Office 365 deployments.

See you in the cloud.

But, in customer environments that have slow or “big” replication, we have found that running the script that disables the recipient policy right before the move doesn’t work and we need to add some replication buffer time.  Because of replication issues, one DC will not receive the replicated object that has the disabled recipient policy, but sees that the target address has been populated, and adds the target address to proxyaddresses as the primary SMTP address!  This means that when the migrated user sends email to external recipients, the reply address is something like MMT_johnDoe53232411231221@mgd.customer.com, which may not be routable or exist in the customer’s SPAM/AV solution and is NDR’d.

This doesn’t just apply to BPOS, mergers/acquistions/divestitures that are moving from one forest to another may also experience this problem.  The BPOS team has brought up this issue with the Exchange team to determine the logic of populating ProxyAddresses with TargetAddress if it exists, and why it is set to the Primary SMTP address.   The BPOS team has also requested a change that allows the command to specify a specify DC that will stamp all the changes to avoid replication issues.  I will post any news that I get on this, but for now add some buffer to the script that disables the source recipient policy.

UPDATE: Please note that this information applies to Exchange 2003 and the RUS.  MRS attempts to diasable the RUS for the mailbox that will be migrated, but can be delayed during replication.  So, the RUS can also stamp the proxyaddresses with the targetaddress value if the replication issues occur.

Basically, Outlook will attempt to locate your mailbox by going through a series of steps between AD and DNS.  Once one of it’s checks succeeds, it contacts the Web Services for your mailbox and pulls down the settings for your Outlook 2007/2010 client.  The “BPOS-D Pre-migration Autodiscover” slide to the left shows the normal autodiscover process.

If you are moving mailboxes from EX2007 to EX2010 inside your Exchange organization (Intra-Org), than your servers know about each other and will be able to issue the correct autodiscover settings.  But, if you are moving mailboxes out of your organization (Inter-Org) either cross forest or to a platform like BPOS, you will have autodiscover challenges.   You might be tempted to change the IP address for your autodiscover.contoso.com to point to the new environment or change SCP records, but there is actually a pretty easy solution.

You can use move-mailbox to migrate mailboxes cross forest, in the case of BPOS we have our own wrapper around move-mailbox that is called MMT.  MMT has it’s own workflows where we import a CSV file that has migration time windows and has information about the users to be migrated.  Both MMT and move-mailbox do the following for Exchange to Exchange migrations:

• Migrates the user’s mailbox content
• Strips the user’s mailbox, but keeps objects such as proxyaddresses (user1@contoso.com)
• Adds a targetaddress to the user (user1@mgd.contoso.com)

The target address is responsible for forwarding mail to the target platform during coexistence (MX record pointed to on-premise Exchange server during coexistence), but the target address is also used for autodiscover.  For BPOS, MMT sets the target address with an “mgd” prefix in the SMTP address, example: user1@mgd.contoso.com, but this could be anything unique for a cross forest move as long as you have control of the DNS records.  The “Mailbox Migration Attributes” slide below shows some of the more common attributes that are changed during move-mailbox or MMT migrations

After the user’s mailbox has been moved cross forest or cross org, Outlook will still search AD for SCP records when connected to the domain. The SCP records point at the old autodiscover URL and autodiscover will fail at this step, but continue to try more autodiscover steps.  After several autodiscover lookup failures it will find the targetaddress attribute, and concatenate “autodiscover” as a prefix to the SMTP domain and will use DNS to resolve the CAS server of the target platform, example: https://autodiscover.mgd.contoso.com. 

So, in order for the target address to be used by Outlook for autodiscover resolution, a DNS sub-domain needs to be created for the SMTP domain used in the address.  For BPOS customers, a DNS sub-domain called MGD is required and an A-record created that points at the BPOS services.

Wait, what is BPOS?  BPOS (Business Productivity Online Suite) aka Microsoft Online is Microsoft’s infrastructure in the cloud which currently includes Exchange, SharePoint, OCS and LiveMeeting.  Customers pay a monthly fee directly to Microsoft based on the number of users which covers their server licenses and operational costs.  If you do that math, Microsoft can run the service more efficiently than most companies can run their own services.  For those of you already calculating operating expenses in your head, remember to throw in:

• Personnel salaries
• Hardware cost
• Software license costs
• Real Estate
• Power/Cooling
• Support Agreements
• Upgrade to next version costs

A couple other things to consider is that if you are a large company, you most likely have a multi year Enterprise Agreement that doesn’t allow your licensing costs ever go down if your user population goes down.  You will need to bump up your connection to the Internet or Microsoft datacenters since your services are now hosted “in the cloud”.  Lastly, does your company deliver 99.9% uptime?  BPOS has a 99.9% financially backed SLA through both High Availability and Disaster Recovery.

BPOS has a long, mature history.  It is based on HMC which was first officially release around 2003.  Before that, it was called MCIS (Microsoft Commercial Internet Server) which was deployed in the late 1990’s.  Microsoft discontinued the availability of MCIS in 2001, and we helped some really large hosters migrate off MCIS’ Windows NT/Site Server/Exchange 5.5 base to what some would consider the first version of HMC which was Windows 2000/Exchange 2000 based.  HMC has been used over the last 7 years to bend Windows and Exchange into hosting multiple companies (tenants) on the same infrastructure, it was never supported directly through support but by a special team.

BPOS changes everything.  The products are designed to be hosted, multi-tenant, and have real support from the product teams and the support organization behind them!  In addition, Microsoft allows customers to have hybrid deployments were some users might be in the cloud, while some are still on-premise.  BPOS has been in use by small and large customers for over 2 years, so we aren’t new at this by any means.

I am part of a new team that helps customers get ready to move and migrate to the cloud, we call it Microsoft Online Provisioning or Microsoft Premier Provisioning.  I hope to use this blog space to highlight some of the more interesting things we find along the way.  It is like a consulting engagement but moves about 10 times as fast, and is a constant roller coaster ride.  I love it.

I help out a small company from time to time because they have 15 employees and a Small Business Server 2003 environment.  They are constantly running out of space on their 5 year old server because mail boxes keep growing because of attachment sizes.  These guys are the perfect scenario to migrate to Microsoft Online!

So, I setup a free trial and started loading some of the coexistence tools like email sync and dirsync onto the Small Business server.  Well, that was the plan.  Turns out, dirsync can’t be run on a domain controller and will only run on Windows Server 2003.  I think the BPOS guys missed the Small Businesses aren’t going to have an extra server lying around.  How can you miss this scenario when building your tools, especially a segment of the market so perfect for BPOS?

So, they will have to forgo the coexistence and migrate mailboxes in one fell swoop over a weekend, which won’t be pretty over the small network connection they have.

There is a slight challenge with this setup because technically Microsoft supports this configuration, but doesn’t give you great tools to setup Single Sign On (SSO).  When Vista was first introduced, Microsoft created a new credential manager that could handle SSO for Terminal Server as well as products such as HyperV.  Fortunately, the product team also back-ported the credential manager (CredSSP) functionality to Windows XP.  While Vista has an easy enough local Group Policy you can edit, Windows XP never got the same treatment. In order to get it to work in XP and XPe, you have to make a bunch or registry edits, which are also not provided in an easy to copy .REG format.

Well, as a service to the public, I have included a text copy of my .REG file below. The information below is provided as-is, no warranty, no support, please don’t cry to me.  But, I have tested it pretty thoroughly and it seems to work.

A couple caveats:

• If you use a smartcard to authenticate to Windows, no matter how hard you try you won’t be able to get an RDP session to honor your Windows credentials, you will always be prompted for credentials when running MSTSC or a .RDP file.  This is counter-intuitive as you would think 2 factor authentication would be more trusted than simple username/password, but it is a known limitation in Windows XP.  Citrix does provide their own credential manager that can add functionality here.
• One of the registry entries is in hex so you can’t see what it is.  It is one of two entries that require you to APPEND the necessary settings for CredSSP to work.  If you have other entries for GINA’s or other credential providers, please be careful as this will overwrite them with the default+CredSSP entries

Many thanks to Olga and Sergey on the product team as well as Kevin Martin from HP for their help this week.

References:

http://support.microsoft.com/default.aspx/kb/951608

http://blogs.msdn.com/rds/archive/2007/04/19/how-to-enable-single-sign-on-for-my-terminal-server-connections.aspx

Here is my .REG file, I hope to create an ADM file at some point that I can share.  You can go ahead and cut/paste the rest of this blog entry into a text file and rename it to a .REG file.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, credssp.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Security Packages"=hex(7):6b,00,65,00,72,00,62,00,65,00,72,00,6f,00,73,00,00,\
  00,6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,73,00,63,00,68,00,61,00,6e,00,\
  6e,00,65,00,6c,00,00,00,77,00,64,00,69,00,67,00,65,00,73,00,74,00,00,00,74,\
  00,73,00,70,00,6b,00,67,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation]
"AllowDefaultCredentials"=dword:00000001
"ConcatenateDefaults_AllowDefault"=dword:00000001
"AllowDefCredentialsWhenNTLMOnly"=dword:00000001
"ConcatenateDefaults_AllowDefNTLMOnly"=dword:00000001
"AllowFreshCredentials"=dword:00000001
"ConcatenateDefaults_AllowFresh"=dword:00000000
"AllowFreshCredentialsWhenNTLMOnly"=dword:00000001
"ConcatenateDefaults_AllowFreshNTLMOnly"=dword:00000000
"AllowSavedCredentials"=dword:00000000
"ConcatenateDefaults_AllowSaved"=dword:00000000
"AllowSavedCredentialsWhenNTLMOnly"=dword:00000000
"ConcatenateDefaults_AllowSavedNTLMOnly"=dword:00000000
"DenyDefaultCredentials"=dword:00000000
"ConcatenateDefaults_DenyDefault"=dword:00000000
"DenyFreshCredentials"=dword:00000000
"ConcatenateDefaults_DenyFresh"=dword:00000000
"DenySavedCredentials"=dword:00000000
"ConcatenateDefaults_DenySaved"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowDefaultCredentials]
"1"="TERMSRV/*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowDefCredentialsWhenNTLMOnly]
"1"="TERMSRV/*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentials]
"1"="TERMSRV/*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowFreshCredentialsWhenNTLMOnly]
"1"="TERMSRV/*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentials]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\AllowSavedCredentialsWhenNTLMOnly]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\DenyDefaultCredentials]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\DenyFreshCredentials]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CredentialsDelegation\DenySavedCredentials]

I was in St. Paul, MN for most of that week and had some minor lower back pain, which started to creep down to my right leg during the week.  I flew home Wednesday afternoon, and hung out with neighbors in the evening as the kids rode bikes, etc. I couldn't walk much or stand without wincing in pain.  I figured a good night of sleep in my own bed with some Tylenol is what I needed.

I woke up the next morning and couldn't put any pressure on my right leg.  My wife rushed me to the Emergency Room where they had to wheelchair me in.  Despite the fact that I couldn't walk, the ER doctor looked me straight in the face and said there was nothing wrong with me other than some pain.

The only reason I didn't rip Mr. ER DOC a new one, was that amidst the pain in the car, I called a neighbor of mine who happens to be a radiologist, Dr. Chris McClaughlin.  Chris prepared me for the fact that the ER would help me manage the pain, but would not run an MRI which would be required to diagnose what was happening.  While I was getting my fix from my dealer, Chris arranged through my doctor to have an MRI that afternoon.

Turns out that after running 3 half marathons and many smaller races, working on a deck, and the rigors of travel, I had a herniated disk.  To be specific a herniated L5 disk with Radiculopathy.   For those not attending med school this semester, this means that a disk in my spine bulged out and is laying on one of my nerves that go to my right leg. In the figure to the right I circled where the hernia is extended out of the disk (big oval shaped thing above it).

Chris consulted with the on-call Radiologist and my primary doctor on the diagnosis from his home.  After a few days of heavy duty pain medication and a dose of steroids to reduce the size and affect of the disk, Chris showed me some of the technology that allows him to do view these from home as well as the extent of my injury.  He typically doesn't diagnose things from home, and is usually in an office with very expensive, high end monitors and speedy networks.  They are all digital, so they can read images from multiple hospitals at once.

To allow him to see it from home, he uses a SSL based portal that he helped create since he is one of the IT guys in his practice.  He selects the patient records, and then can view the MRI from different angles.  It takes longer from home because the MRI's are broken down into a series of high resolution images that need to be cached.  Once they are cached he flips through them with a trained eye to look for abnormalities.  As he does it, I can't make heads or tails of it, and it reminds me of many of us (geeks) as we scan code or scripts.  Once he saw the troubled area, he slowed down and explained to me all about my spine, the disks, how the nerves in your leg work, etc.  I am really appreciative that he could explain what was going on at this level of detail.  I learned long ago that I have a lot more anxiety about health issues if I don't understand what is going on, and what the goals might be to resolve them.

I have a choice; Physical Therapy or Surgery.  After discussing these options with my doctor and Chris, and the outcomes are generally the same, physical therapy was the only choice.  Physical Therapy takes longer, but is affective in shrinking the disk back into shape.  Surgery is quicker, but much more risky.

I am doing physical therapy, and have made a lot of progress.  I don't have pain anymore, and tried to get off the heavy duty medication as quickly as I could.  We are working on getting all the tingling and numbness in my pinky toe to go away.  This involves exercise pretty much every hour, and hanging from an inversion table several times a week.  Once I have 10 full days where I don't have symptoms from the nerve, I can start traveling and lifting small objects.

So, I am here locally in Denver, trying to work on what I can.  Unfortunately, I was let go from a great project in Minnesota because my role required customer face-to-face interaction.  I wish them the best of luck.

My Treo 750, which I really liked, was starting to have some battery fade.  In addition, I was using the IE browser on my Treo more frequently, with more and more contempt for IE on the phone.  I had loaded an experimental browser on it a while back called Deepfish, and it was great (very similar to the abilities of Safari on the iPhone).  But, Deepfish was canceled as a standalone project and will probably be incorporated in a future version of Windows Mobile.

So, I was stuck using the "diet" version of IE on my phone, which made me want to pitch it for distance at times.

I was indoctrinated to the iPhone during a charity event for the Leukemia and Lymphoma society where I took many pictures using people's iPhones as proof they made it to a checkpoint along a race.  I had to fumble into menus on the iPhone, and was instantly hooked by its interface and most of all its Safari browser, even though it was the Edge version at the time.

The stars aligned and I ordered one.  Below are a few observations (please note that I don't care about iPod functionality because my Zune is way, way better).

Pros:

• Now with Exchange Active Sync (EAS), see cons section for some quirks with EAS
• EAS means security policy pushed from Exchange server, ability to remote wipe if lost
• Safari browser rocks!
• Overall Interface is excellent
• GPS and Google maps integration
• Camera is pretty good, interface for pictures is excellent
• Good Facebook application add-in
• Haven't had issues with it unlocking keys randomly in my pocket like I did with a "key locked" Treo
• Better interface to read emails than on the Treo, especially expanding the reply list.

Cons:

• Battery life, can't make it an entire day even with Wifi turned off
• I miss Voice Command!!! I got used to not taking my phone out of my pocket/holster and using voice to call someone and it telling me who was calling.  This might be coming in the near future from the application store.
• Can't sync individual folders with EAS, it is "last 200 of items".  I have a folder with all my travel plans and it usually isn't in the "last 200 items"
• Calendar sync is screwy.  Even though I accept an appointment in Outlook, the phone insists on me accepting it again.
• Can't query other's calendars
• Attachments aren't automatically downloaded, only when you click on them 
• Some applications from the application store are deemed "too big" so you have to use iTunes to download them.  I have an all-you-can-eat data plan, why can't I use my 3g connection?
• Smudges, grease spots, makeup (not mine of course).  All inherent with a touch screen, reminds me of the old TMo XDA
• One handed navigation was a Treo trademark, and still is.  Apple can't match its one-handidness
• Can't flip things like email on its side for reading.  Only browser and camera seem to flip on their side.
• GPS isn't real GPS.  I believe it must use cell towers or something because it isn't nearly as accurate as my Garmin.  Probably a fix in the future...

Verdict:

• The browser alone is worth it, I can live with all the quirks
• Apple needs to actually pick up a Windows Mobile phone and use it like millions of WinMo customers have been for years.  Take some notes, and refine the experience more on the iPhone.
• Where can I get an extended battery?  Oh wait....

Note: If you have solutions to any of the issue or quirks, please post a comment.

Update: Added Con about querying calendars and con about attachments.

I liked the business aspect of the job a lot, enough to inspire me to move to a new team.  I have moved onto the West Architecture team and will be working with customers throughout the Desert, Mountain, and SoCal parts of the US.  It includes working with CIO's and VP's at numerous customers and helping account teams figure out how Microsoft can help them solve customer problems.  I hope to be involved in a lot of sales cycles from initial talks all the way to implementation, ensuring that out technologies are deployed the best possible way.

Sounds kinda like a sales guy, sorry about that....