How to Manage Multiple Forest

Question

Hello Guys,

I have two forest. ARS is installed in one forest and is perfectly working fine. I need to use the same ARS installation to provision / re-provision / de-provision users in another forest.

I have created a trust between this two forest. Created a separate ARS service account (member of domain admin and exchange organization admin) in another.

What are the necessary pre-requisite for such setup?
Do I have to install ARS service in the other forest as well?

Thanks
sameer

Aidar.Karabalaev · Answer

ARS is per domain (regardless of Forest) tool. 
ARS does not have explicit configuration option to point to few Exchange Orgs. 
From Exchange standpoint, Exchange as a Resource can span different AD Forests as Auth Masters. 
I would recommend to open Support Case to confirm that the situation with few Exchnage Forests is supports. ARS reads Exchange Org from CN=Confiruration,DC=Forest1 and, maybe will read few Forests if Managed Domains1,2 belong to different Forests.

Terrance.Crombie · Answer

By default, Active Roles will check for Microsoft Exchange servers only within the same Forest where the Active Roles server is present. This behaviour can be changed by using one of the edsvaExchangeProperties flags. 
 
This one should be relevant:

ForceViewEntireForest 
 
Default Value: False 
 
Active Roles Version(s): 7.0+ 
 
When this parameter is set to True, and no Exchange Server is found in the domain of the Exchange recipient being administered, Active Roles configures its Exchange management session to view all the Exchange objects in the forest (equivalent to the Set-AdServerSettings -ViewEntireForest $true command in the Exchange Management Shell). 
 
Without this parameter, Active Roles is unable to manage Exchange recipients in the domains where Exchange Server is not installed.

In order to set this flag, run the following VB Script once as an Active Roles Administrator to update the central setting in the Active Roles Configuration database, and then restart all Active Roles services sharing that database: 
 
option explicit 
 
Const NewExchangeProperties ="" 
Const strEdsvaExchangeProperties = "edsvaExchangeProperties" 
Const strXPath = "/ExchangeProperties" 
Const strSuccessString = "Exchange Properties updated successfully." 
 
Dim objServiceObject : Set objServiceObject=GetObject("EDMS://CN=Server Configuration,CN=Configuration") 
 
Dim strXML 
On Error Resume Next 
objServiceObject.GetInfoEx Array(strEdsvaExchangeProperties) ,0 
strXML = objServiceObject.Get(strEdsvaExchangeProperties) 
On Error GoTo 0

if (IsEmpty(strXML)) then 
objServiceObject.Put "edsvaExchangeProperties", NewExchangeProperties 
objServiceObject.SetInfo 
WScript.Echo strSuccessString 
else 
 
Dim objXDoc : Set objXDoc = CreateObject( "Msxml2.DOMDocument.6.0" ) 
objXDoc.setProperty "SelectionLanguage", "XPath" 
objXDoc.async = False 
objXDoc.LoadXML strXML 
 
Dim objNode : Set objNode = objXDoc.selectSingleNode( strXPath ) 
 
If objNode Is Nothing Then 
 
WScript.Echo "Fail: Wrong XML format" 
 
Else 
 
objNode.setAttribute "ForceViewEntireForest","true" 
 
objServiceObject.Put "edsvaExchangeProperties", objXDoc.xml 
objServiceObject.SetInfo 
WScript.Echo strSuccessString 
End If 
 
End If

Endpoint Privilege Management

How to Manage Multiple Forest