Monday, November 18, 2013

When Impersonate Permissions Fail DURING a Migration

Interesting case came up this weekend.  

An 850 user Beehive to Exchange Migration validated fine (notable for two things: First European Beehive migration and first multiple instance Beehive migration) and then while in migration started throwing impersonate errors for what became a total of ten users.

Now ten out of 850 is about 1% -- which to us is still too great an error rate for us to tolerate.  

But it seemed really wasteful to undo the entire migration for ten users.

Here's what we did.

We modified the insertion to allow for a single user.  Not via validation of that user which is a good test procedure but it would be insufficient here.  You need the validation file to be as entire as you can get it -- otherwise there will be inaccuracies.

First fix your permissions issues with those users.

THE ABSOLUTELY SAFEST WAY
Here are the steps we recommend:
  •     Create a new sub directory for each of the accounts.  Remember to copy configuration and the two account validation and mapping files
  •       Launch the bcalreader UI, and set the lower and upper limit for the first account’s SMTP address root, e.g.:  “jimi.hendrix” to “jimi.hendrix”
  •     If there are multiple accounts that have this root, follow the limit values with an “@” sign.  For example, if you have two accounts “jimi.hendrix”, “jimi.hendrix2”, and you only want to process “jimi.hendrix”, set the limits: “jimi.hendrix@” TO “jimi.hendrix@”           Otherwise the tool will migrate “jimi.hendrix” and “jimi.hendrix2”, and you will end up with duplicates in the “jimi.hendrix2”’s mailbox.
  •     Validate, then press the “process all” button.
  •     Repeat for other users

NOTES
  • This inserts all meetings/contacts/tasks owned by the user, and process all invitations received from other users.
  • However, it will NOT process invitations sent from this account to other accounts.  Those invitations will remain in his invitee’s in-boxes.  We suggest you leave it that way.
  • Communicate to your end users that the migration may have left some meeting invitations in their inbox.  Suggest they process those invites the way they did in Beehive (e.g., if they accepted the invite in Beehive, accept the one in Outlook;  If they declined the invite in Beehive, decline it in Outlook.


THE ABSOLUTELY BEST WAY
The best way in this case means getting the outcome you could have had if the impersonate had not failed.  But it is a little more intricate and has the possibility you press the wrong buttons.

Do this in the cold light of morning.  It is way too easy to hit the wrong button when you are sleep deprived and stressed. 

  • Create a sub-directory that you will use to process the accounts that had impersonation problems.
  • Copy bCalReader v2.0.11 or greater and the validation file.
  • Change the limit to the account.  Put an “@” after the SMTP address, e.g.: “Jimi.Hendrix@”
  • Press “Process All”.
  • Repeat for the remaining accounts.
Once you have added data from the impersonation-problem accounts, return to the “main instances” of bCalReader.

For each of these instances:
  1. Check the “show individual steps”, and re-process the invitations as follows
  2. Press the “Respond to Invitations” button on each instance.  When they are all done,
  3. Press the “Apply response Exceptions” button on each instance.  When they are all done,
  4. Press the “Update Tracking Info” button on each instance.  When they are all done,
  5. Press the “Final Cleanup” button on each instance.  
  6. When they are all done, you are finished! 

No comments: