ForestPrep and DomainPrep

  • Article
Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.

Published: August 1, 2000 | Updated : June 14, 2001

On This Page

Introduction
Why Do You Need ForestPrep and DomainPrep?
ForestPrep
DomainPrep

Introduction

Before installing Microsoft® Exchange 2000 Server, you must prepare your Microsoft Windows® 2000 forest. Specifically, the schema in the Microsoft Active Directory™ directory service must be extended to accommodate Exchange, and permissions must be granted to the users or groups who will be installing the first Exchange 2000 server. Then, in every domain that will host either an Exchange server or mail-enabled users, two security groups must be created. These security groups provide your Exchange servers with the permissions they need to perform administrative functions. Included on the Exchange 2000 Server CD are two utilities for accomplishing these tasks: ForestPrep and DomainPrep.

This Exchange Up-To-Date article summarizes the benefits of each utility, as well as the permissions required to run them. It also describes some best practices and what you need to know before running ForestPrep and DomainPrep.

Note: For a screen-by-screen description of ForestPrep and DomainPrep, see the white paper "Quick Guide to Upgrading from Exchange version 5.5 to Exchange 2000". For a thorough examination of recommended methods for migrating from Microsoft Windows NT® version 4.0 and Exchange 5.5 to Windows 2000 and Exchange 2000 Server, see the Exchange Up-To-Date article, "Exchange in Six Steps," an extensive, step-by-step tour of deployment.

Why Do You Need ForestPrep and DomainPrep?

Many organizations do not want their messaging administrators to have high-level domain or enterprise rights. In fact, it is common for Exchange administrators to be a separate team from the people who design and maintain the company intranet. Organizations running Exchange 5.5—which has its own directory—can function in this manner, but Exchange 2000 uses Active Directory and therefore requires, in larger organizations especially, that the network and messaging teams work together to ensure optimal performance.

For organizations that don't yet have such a structure in place, ForestPrep and DomainPrep collectively separate the Exchange 2000 setup tasks that require high-level network permissions from those that do not. For example, Windows 2000 administrators with EnterpriseAdmin and SchemaAdmin permissions run ForestPrep, during which they designate an account as the Exchange 2000 administrator. This Exchange administrator will have enough rights (after both utilities are run) to perform the actual Exchange 2000 installation.

ForestPrep

The ForestPrep utility performs all Exchange 2000 setup tasks that require EnterpriseAdmin and SchemaAdmin permissions, as it makes changes in the configuration container of Active Directory. ForestPrep extends your Active Directory schema to include Exchange-specific information. ForestPrep also creates objects in Active Directory and gives permissions on those objects to the account designated as the Exchange 2000 administrator. This administrator will ultimately have enough permissions to install the first Exchange 2000 server in your organization.

Note: The account designated by ForestPrep as the Exchange 2000 administrator has the same rights as an organization-level Exchange Full Administrator created by the Exchange Administration Delegation Wizard. After you have installed Exchange 2000, the Exchange administrator can use this wizard to create additional Exchange administrators. It is not necessary, or recommended, to run ForestPrep again to create additional Exchange administrators. To do so monopolizes your system resources every time ForestPrep examines your schema.

For more information on the Exchange Administration Delegation Wizard, see your Exchange 2000 online documentation.

ForestPrep also creates the Exchange organization name and object in Active Directory. You need to run ForestPrep only once per Windows 2000 forest.

Important: After ForestPrep and DomainPrep are run, the designated Exchange administrator has only enough permissions to install Exchange. By default, this account is not able to create accounts or give users mailboxes unless this account is also a member of the Account Operators group.

You can grant administrators permissions to create and administer Windows accounts within your Exchange organization by making them Account Operators or by using the following two methods. Both methods use the Active Directory Users and Computers snap-in. The first is to run the Windows 2000 Delegation of Control Wizard and grant your Exchange administrator control of the Users container. The second is to create a new group specifically for Exchange users within the Users container and grant the Exchange administrator full control of that new group. See the Windows 2000 documentation for more information on the Active Directory Users and Computers snap-in.

Before Running ForestPrep

You need to gather the following information before running this utility. ForestPrep prompts for different information depending on whether you are installing a new Exchange 2000 organization or joining an existing Exchange 5.5 organization.

New Installation

For a new installation of Exchange 2000 Server, the network administrator needs to have the following information before running ForestPrep:

  • The name of your Exchange 2000 organization (this is the name you want to give your new Exchange organization)

  • The account of the person or group who will install the first Exchange 2000 server in your organization

Note: Once Exchange is installed, this person or group is able to create other Exchange administrators by using the Exchange Administration Delegation Wizard.

Join an Exchange 5.5 Organization

When joining an existing Exchange 5.5 organization, the network administrator needs to have the following information before running ForestPrep:

  • The name of an Exchange 5.5 server in the site that you want to join (the server must be online)

  • Your Exchange 5.5 Service account and password

Important: The Exchange 5.5 server you identify must have Service Pack 3 installed, and Exchange Active Directory Connector (ADC) must be installed in the forest. This must be the version of ADC contained on your Exchange 2000 Server CD and not the version that is included with Windows 2000. Exchange 5.5 SP3 provides ForestPrep with information about your Exchange 5.5 organization.

There is some overlap between network permissions and Exchange permissions when you join an Exchange 5.5 site. Specifically, the account running ForestPrep must have Admin permissions on both the Exchange 5.5 site you want to join and on the configuration container for that site. Because Exchange 5.5 has its own directory, separate from Windows 2000 Active Directory, even an EnterpriseAdmin in your organization might not have these permissions on your Exchange 5.5 site.

What Are the Requirements for Running ForestPrep?

For ForestPrep to work effectively, it must be run under the following conditions:

  • ForestPrep must be run in the same domain as the Schema Master (by default, this is your parent domain).

  • The person running ForestPrep must have both EnterpriseAdmin and SchemaAdmin permissions.

  • When joining an Exchange 5.5 site, the account running ForestPrep must also have Admin permissions for both the Exchange 5.5 site and the configuration container beneath it.

When Should You Run ForestPrep?

Most deployment scenarios require you to run ForestPrep for successful Exchange 2000 installation. In particular, if your Exchange administrator doesn't have EnterpriseAdmin and SchemaAdmin permissions, you must run ForestPrep.

Note: To install Exchange 2000, the Exchange administrator must have administrator rights on the local server in addition to those rights granted by ForestPrep. However, this is not necessary if the administrator is a DomainAdmin, because the DomainAdmin group has administrative permissions on all computers in the domain.

When installing Exchange 2000 in a child domain, you must first run ForestPrep in the parent domain. If you don't do this, Setup will prompt you to do so when you attempt to install in the child domain.

When Is It Unnecessary to Run ForestPrep?

You should run ForestPrep before installing your first Exchange 2000 server—regardless of your organization's topology. However, there are some scenarios (such as in a small business) in which ForestPrep might not be required.

ForestPrep and DomainPrep both run automatically during Setup, but only if the Exchange administrator account is a member of the SchemaAdmin and EnterpriseAdmin groups and if the first Exchange 2000 server installation takes place in the same domain as the Schema Master.

When this is the case, you do not need to manually execute either utility. By default, the account with which you have logged on becomes the designated Exchange 2000 administrator.

Note: Remember that anyone installing Exchange has to be either an administrator on the local server or a DomainAdmin in that domain. To install the Key Management Service (KMS) component of Exchange, however, Exchange administrators must have EnterpriseAdmin rights, or DomainAdmin rights in any child domain in which they intend to install Exchange and KMS.

Running ForestPrep

To run ForestPrep:

  1. Insert the Exchange 2000 Server CD in your CD-ROM drive.

  2. On the Start menu, click Run.

  3. Type E :\setup\i386\setup /ForestPrep, where E is your CD-ROM drive.

Important: Type the command exactly as written. If you make any errors, ForestPrep will not install.

This article provides only best practices and overview information about ForestPrep. For complete step-by-step instructions for running the ForestPrep utility, see "Installing Exchange" in Exchange 2000 Server Planning & Installation. See also the white paper, "A Quick Guide to Upgrading from Exchange 5.5 to Exchange 2000," available at https://www.microsoft.com/exchange.

Allow Time for Replication

After you run ForestPrep, be sure to allow enough time for the schema extensions to replicate throughout all the domains and sub-domains in your organization. Depending on the geography of your organization and the speed of your network connections between Windows 2000 sites or domains, this could take some time. You should run DomainPrep only after you're sure that the Exchange-specific information has been replicated across your organization.

Note: Replication is slower between Windows 2000 sites than within a site. You should consider this if your organization consists of multiple Windows 2000 sites.

DomainPrep

The DomainPrep utility performs the Exchange setup tasks that require DomainAdmin permissions; it should be run by a member of the DomainAdmin group. You need to run DomainPrep once in each domain that contains an Exchange 2000 server and in any domain that hosts Exchange users. (An Exchange domain that contains mail-enabled users, but no Exchange servers, is a user domain.) This utility creates the groups and permissions necessary for Exchange servers to read and modify user attributes.

DomainPrep creates two new domain groups: Exchange Domain Servers (a Windows 2000 global security group) and Exchange Enterprise Servers (a Windows 2000 domain local security group).

Important: For more information about Windows 2000 group types, see "The Role of Groups and Active Control Lists in Microsoft Exchange 2000 Server Deployment" elsewhere on the Exchange Up-To-Date Web site.

DomainPrep also creates the Public Folder proxy container in Active Directory. While ForestPrep works in the forest-wide configuration container, the Public Folder object—Microsoft Exchange System Objects—exists outside this container. DomainPrep creates this object on a per-domain basis, under the domain container.

Exchange Domain Servers Group

The Exchange Domain Servers global security group contains the computer accounts of all Exchange servers in the domain. Though it is created by DomainPrep, the Exchange Domain Servers group is not populated until the actual installation of Exchange 2000.

The Exchange Domain Servers group is necessary for Recipient Update Service, which is needed in every domain of your Exchange organization. This includes user domains, which do not contain Exchange servers but do have mail-enabled users. Recipient Update Service is used by Exchange to generate and update default and customized address lists and to process changes made to recipient policies.

For more information about Recipient Update Service, see the Exchange 2000 online documentation.

Exchange Enterprise Servers Group

The Exchange Enterprise Servers group consists of every Exchange Domain Servers group in your organization. In other words, every domain with an Exchange server, along with every domain in which DomainPrep has been run and that has an active Recipient Update Service, belongs to the Exchange Enterprise Servers group.

This group is populated immediately when DomainPrep adds the Exchange Domain Servers group from the current domain to it. Recipient Update Service eventually adds the Exchange Domain Servers groups from all other domains that have an active Recipient Update Service.

Before Running DomainPrep

A benefit of DomainPrep is that, unlike ForestPrep, the network administrator running the utility does not need to know anything about your Exchange organization. If you are joining an Exchange 5.5 site, no Exchange 5.5 information is required either.

What Are the Requirements for Running DomainPrep?

You must meet the following requirements before you run DomainPrep:

  • The account that runs the DomainPrep utility must belong to the domain's DomainAdmin group.

  • ForestPrep must have already been run in your Windows 2000 forest.

  • The schema extensions made by ForestPrep to Active Directory must have already replicated throughout your organization.

When Must You Run DomainPrep?

For DomainPrep to work correctly, you must run it:

  • After running ForestPrep,and after all ForestPrep changes are replicated throughout your organization.

  • Before your Exchange 2000 administrator, as designated by ForestPrep, can install the first Exchange 2000 server in the domain.

  • Whenever you want to create Recipient Update Service for a user domain (a domain with mail-enabled users but no Exchange servers).

When Is It Unnecessary to Run DomainPrep?

Typically, you should run DomainPrep before installing your first Exchange 2000 server, but it might not be required in certain scenarios. For example, if the account that is installing the first Exchange 2000 server in the domain is an Exchange Full Administrator and a member of the DomainAdmins group, you do not need to run DomainPrep. The same is true if the person installing Exchange has EnterpriseAdmin permissions.

In both scenarios, DomainPrep runs automatically as a hidden component during Exchange installation.

Running DomainPrep

To run DomainPrep:

  1. Insert the Exchange 2000 Server CD in your CD-ROM drive.

  2. On the Start menu, click Run.

  3. Type E :\setup\i386\setup /DomainPrep, where E is your CD-ROM drive.

This article provides best practices and overview information about DomainPrep only. For complete step-by-step instructions for running the DomainPrep utility, see "Installing Exchange" in Exchange 2000 Server Planning & Installation. Also, see the white paper, "A Quick Guide to Upgrading from Exchange 5.5 to Exchange 2000," available at https://www.microsoft.com/exchange.