There has been a bit of traffic on the various MIIS forums lately about just how to create Exchange 2007 Mailbox-Enabled users. Well, fortunately ILM 2007 makes this task much easier, but it can also be done with just a bit more effort with MIIS and IIFP. Regardless of the platform you are running make sure you have the latest updates applied for your version of the ILM engine (IIFP, MIIS, or ILM).
In addition to installing the latest products updates for you version of the Identity Management tool you will also need to install the following:
Why do I need Powershell and the Exchange Management Tools?
Powershell and the Exchange Management Tools are required by ILM to allow the “Enable Exchange 2007 Provisioning” option. Checking this option causes ILM to run the Exchange2007Extension.dll after each export to Active Directory. In short the Exchange2007Extension.dll runs the “Update-Recipient” Powershell command for each mail-enabled object that is created or modified during the export. You could simulate the same process by running the “Update-Recipient” command manually too.
With Exchange 2000 and 2003 you either called the ExchangeUtils api to create the mail-enabled object or you provisioned the object and then stamped the appropriate mail related attributes. After exporting the changes to Active Directory the Recipient Update Service (RUS) would detect the changes and mail-enable the object. Exchange 2007 did away with the RUS and now we use the “Update-Recipient” command.
Now for the good stuff…
If you are running ILM 2007 you can now provision mail-enabled objects like you did with MIIS and IIFP using the ExchangeUtils apis. For example, provisioning a mailbox-enabled user would look something like the following (in C#):
ConnectedMA ma = mventry.ConnectedMAs[ILMConfiguration.HostedMAName];
ReferenceValue dn;
CSEntry csentry;
dn = ma.EscapeDNComponent("CN=" + mventry["cn"].Value).Concat(mventry["container"].Value));
csentry = ExchangeUtils.CreateMailbox(ma, dn, mventry["mailNickname"].Value, homeMDB);
csentry["description"].Value = "Account created by MIIS on " + DateTime.Now.ToString();
After the export runs ILM will automatically run the “Update-Recipient” command and enable the user for Exchange.
Now this is great if you are running ILM 2007, but what if you aren’t?
How do you enable objects for Exchange 2007 with MIIS and IIFP?
This task is a bit easier than it would seem. I have come up with two options that are quite simple to implement depending on your coding skills. The good part is you should not need to change your provisioning code.
Step 1 – create an export log file
Modify your export run profile to create a log file. When you choose this option the file name you specify will be created in the C:\Program Files\Microsoft Identity Integration Server\MaData\MA-NAME directory, where MA-NAME is the name of your MA.
The log file is written in XML format and should be pretty straightforward to understand. Each object will start with an entry like below, with additional XML tags for each attribute that is being written to AD.
<delta operation="add" dn="CN=John Doe,OU=Users,OU=Accounts,DC=Company,DC=com">
Step 2 – process the log file
I have experimented with two methods for processing entries in the log file. The first method I used was to write a script to parse the log file and write all the dn values to a delimited file. The resulting csv file would look something like:
dn
"CN=DL2,OU=Groups,OU=Accounts,DC=Company,DC=com"
"CN=John Doe,OU=Contacts,OU=Accounts,DC=Company,DC=com"
"CN=Sally Smith,OU=Users,OU=Accounts,DC=Company,DC=com"
After the csv file is created just the following Powershell command and Exchange will do the rest.
import-csv c:\powershell\process-recipients.csv | foreach {update-recipient -identity $_.DN}
The next method I came up with does basically the same thing, except it doesn’t require creating a csv file or creating a Powershell script. By doing a little digging I discovered that Powershell commands can be invoked directly from a .Net application. So, I ended up creating a .Net program to process the XML log file and run the Powershell Update-Recipient command. Less moving parts makes life easier. Below is a snippet of the code I came up with (written in C#). You will find more information on invoking Powershell from .Net here.
namespace My.Library
{
public class Powershell
{
private static RunspaceConfiguration rsc;
private static Pipeline pipeline;
private static PSSnapInException warning;
public static void Execute(string cmd)
{
try
{
rsc = RunspaceConfiguration.Create();
rsc.AddPSSnapIn("Microsoft.Exchange.Management.Powershell.Admin", out warning);
Runspace rs = RunspaceFactory.CreateRunspace(rsc);
rs.Open();
pipeline = rs.CreatePipeline(cmd);
pipeline.Invoke();
rs.Close();
}
catch (Exception ex)
{
throw new Exception(ex.Message);
}
}
public static void UpdateRecipient(string identity)
{
Execute("Update-Recipient -Identity \"" + identity + "\"");
return;
}
}
}