A very common question in support concerning GALSync is what are the permissions needed for the GALSync User Account to make GALSync work. I have documented this information below to help understand what is needed for GALSync to work.
The GALSync User account is the account specified on the “Connect to Active Directory Forest” tab in the GALSync Management Agent Properties.
The GALSync User must be a part of the Exchange Recipient Administrators group. The GALSync user must be a part of this group, in order to run the Microsoft Exchange PowerShell CmdLet Update-Recipient .
Information from the Update-Recipient Page.
For more information about permissions, delegating roles, and the rights that are required to administer Exchange 2007, see Permission Considerations .
The Update-Recipient PowerShell CmdLet updates an exported mail-enabled contact object so that it can be seen in the GAL.
You must have the Microsoft Exchange Server 2007 Management Tools Service Pack 1 or later (preferred Service Pack 3) installed on the Synchronization Service Engine machine.
The reason for this is that the PowerShell CmdLet Update-Recipient is installed with Service Pack 1 or later. This is a local call to Update-Recipient, which is the reason we need the Exchange 2007 Management Tools installed on the Synchronization Service Engine machine.
The GALSync User must be a part of the Organization Management Exchange Security Group.
Again, the GALSync user must be a part of this group, in order to work with the Microsoft Exchange PowerShell CmdLet Update-Recipient .
Please note the requirement for Organization Management is an Exchange 2010 Required permission.
In order to Test PowerShell, or view the settings of the PowerShell VDIR in Microsoft Exchange 2010, you must be part of the Organization Management Exchange Security Group. More information click here.
Provisioning to Exchange 2010, we now utilize WinRM and PowerShell v2.0 to update the mail-enabled contact objects that we export so that they can be seen in the GAL.
In order for us to remotely call the Update-Recipient CmdLet, we need to know where the Microsoft Exchange 2010 Client Access Server is located. Review this article to help locate the Exchange 2010 Client Access Server.
Windows PowerShell v2.0 and WinRM (download Knowledge Base article ). In Windows Server 2008 R2 this is a Feature that you can install.
If you have multiple domain controllers in the forest that you are working with in the GALSync solution, then you need to ensure that the GALSync User account has the Replicate Directory Changes permissions.
If the GALSync User account does not have these permissions, then you will receive connection problems when creating a management agent, or when attempting to execute an import or an export to the forest in question.
A source container, are the containers (Organizational Units) to where the Mail-Box Enabled User object is located, or the Authoritative Mail-Enabled Contact Object. GALSync writes an x500 address back to the source object for reply-ability purposes. The GALSync User Account will need “Write ProxyAddresses” on the source objects. Please find below the steps to grant “Write ProxyAddresses” permissions.
Enter the alias (sAMAccountName) of the GALSync User account, and click Check Names to allow the account to resolve.
This permission will be applied to every child object whose “Allow inheritable permissions from the parent to propagate to this object and all child objects” option is selected. This is located in the user’s Advanced Security property sheet. Any user that does not have this selected will not have the permissions granted to it.
In a GALSync solution, the Synchronization Service Engine uses the GALSync user account to create a mail-enabled contact object. You could give the GALSync User account Full Control to this container (Organizational Unit). However, if you need to control permissions, you can set the following permissions to allow GALSync to work successfully.