Installation Guide for Cisco Unity Unified Messaging with Microsoft Exchange 5.5 (With Failover Configured), Release 4.0(5) and Later
Creating Accounts for the Installation and Setting Rights and Permissions

Table Of Contents

Creating Accounts for the Installation and Setting Rights and Permissions

About the Accounts Required for the Cisco Unity Installation

The Account Used to Install Cisco Unity

The Account Used to Access the Cisco Unity Administrator

The Accounts That Cisco Unity Services Log On As

Creating the Accounts Required for the Cisco Unity Installation

Adding the Cisco Unity Administration Account to the Local Administrators Group

Setting Rights and Permissions with the Cisco Unity Permissions Wizard

Setting Required Exchange Permissions


Creating Accounts for the Installation and Setting Rights and Permissions


In this chapter, you do the following tasks in the order listed:


Note If you are installing the secondary Cisco Unity server now, skip Task 1.


1. Familiarize yourself with the domain accounts you will create in Task 2. See the "About the Accounts Required for the Cisco Unity Installation" section.


Note If you are installing the secondary Cisco Unity server now, skip Task 2.


2. Create the applicable domain accounts that are needed to install Cisco Unity. See the "Creating the Accounts Required for the Cisco Unity Installation" section.

3. If you created a Cisco Unity administration account in Task 2.: Add the account to the local Administrators group. See the "Adding the Cisco Unity Administration Account to the Local Administrators Group" section.

4. Set rights and permissions for the accounts that you created in Task 2. See the "Setting Rights and Permissions with the Cisco Unity Permissions Wizard" section.


Note If you are installing the secondary Cisco Unity server now, skip Task 5.


5. Set Exchange permissions. See the "Setting Required Exchange Permissions" section.

When you are finished with this chapter, return to "Overview of Mandatory Tasks for Installing Cisco Unity" to continue installing the Cisco Unity system.


Note The tasks in the list reference detailed instructions in the Cisco Unity installation guide and in other Cisco Unity documentation. Follow the documentation for a successful installation.


About the Accounts Required for the Cisco Unity Installation

This section describes the following domain accounts that are needed for the Cisco Unity installation:

The Account Used to Install Cisco Unity

The Account Used to Access the Cisco Unity Administrator

The Accounts That Cisco Unity Services Log On As


Note The same accounts are required for installing a new Cisco Unity 4.0(x) system and for upgrading from previous versions of Cisco Unity.


The Account Used to Install Cisco Unity

During installation, Cisco Unity creates a number of Cisco Unity objects in the Exchange 5.5 directory, so the account with which you log on to Windows to install Cisco Unity must have proper user rights and permissions to perform the necessary operations.

If you are installing more than one Cisco Unity server in a site—including setting up failover—you can use the same account to install Cisco Unity software on all of the servers.

The Account Used to Access the Cisco Unity Administrator

When you install Cisco Unity, you are prompted to choose the Windows domain account that you want to use to access the Cisco Unity Administrator (the website used to perform most administration tasks). During installation, the domain account is automatically associated with a Cisco Unity subscriber whose class of service allows Cisco Unity Administrator access. (Later you can create additional Cisco Unity subscribers who also can access the Cisco Unity Administrator.)

By default, the Cisco Unity administration account is the installation account. If you prefer to use an account other than the installation account to be the first Cisco Unity administration account, create an additional domain account for that purpose.

The Cisco Unity administration account must be a member of the local Administrators group. A procedure later in this chapter explains how to add the account to that group.

The Accounts That Cisco Unity Services Log On As

During Cisco Unity installation, you are prompted to choose two domain accounts that Cisco Unity services log on as:

The account that Cisco Unity directory and message store services log on as. Directory services keep subscriber data in the directory synchronized with subscriber data in the Cisco Unity SQL Server database. Message store services allow subscribers to send and receive voice messages by using the telephone user interface.

The account that local services log on as. By default, local Cisco Unity services log on as the Local System account. We recommend that you not change this.

Creating the Accounts Required for the Cisco Unity Installation

The procedure in this section requires Active Directory Users and Computers (ADUC). If ADUC is not installed on the Cisco Unity server, do one of the following:

Install ADUC on the Cisco Unity server. For information, refer to Windows Help.

In the domain that includes the Cisco Unity server, go to a computer (for example, the domain controller) on which Active Directory Users and Computers is already installed.

To Create Domain Accounts for Cisco Unity Installation, Administration, and Services


Step 1 On the Cisco Unity server or another server where Active Directory Users and Computers is installed, log on to Windows by using an account that is a member of the Domain Admins group.

Step 2 On the Windows Start menu, click Programs > Administrative Tools > Active Directory Users and Computers.

Step 3 In the left pane, expand the domain, right-click Users or the organizational unit where you want to create the installation account, and click New > User.

Step 4 Follow the on-screen prompts to create the installation account. Creating an Exchange mailbox is optional.

We suggest that you use the following names for the accounts:

Installation

UnityInstall

Administration

UnityAdmin

Account that Cisco Unity directory and message store services log on as (directory and message store services account)

UnitySvc


Step 5 Repeat Step 3 and Step 4 to create the Cisco Unity administration account, and the directory and message store services account.

Ensure that for the accounts that Cisco Unity services log on as, the password will never expire. If the password expires, Cisco Unity will stop working the next time the server is restarted.

Step 6 Close Active Directory Users and Computers.


Adding the Cisco Unity Administration Account to the Local Administrators Group


Note If you did not create a Cisco Unity administration account in the "Creating the Accounts Required for the Cisco Unity Installation" section, skip this section.


Add the Cisco Unity administration account to the local Administrators group on the primary and secondary Cisco Unity servers.

To Add the Cisco Unity Administration Account to the Local Administrators Group


Step 1 On the Cisco Unity server, on the Windows Start menu, click Programs > Administrative Tools > Computer Management.

Step 2 In the left pane of the Computer Management MMC, expand System Tools > Local Users and Groups.

Step 3 In the left pane, click Groups.

Step 4 In the right pane, double-click Administrators.

Step 5 In the Administrators Properties dialog box, click Add.

Step 6 In the Select Users or Groups dialog box, in the Look In list, click the name of the domain to which the Cisco Unity server belongs.

Step 7 In the top list, double-click the name of the Cisco Unity administration account. The name appears in the bottom list.

Step 8 Click OK to close the Select Users or Groups dialog box.

Step 9 Click OK to close the Administrators Properties dialog box.

Step 10 Close the Computer Management MMC.


Setting Rights and Permissions with the Cisco Unity Permissions Wizard

The procedure in this section sets the permissions that Cisco Unity requires for:

The account that you will use to install Cisco Unity.

The account that Cisco Unity directory and message store services will log on as.

In addition, you must set Exchange-specific permissions, as described in the "Setting Required Exchange Permissions" section.

You run the Permissions wizard on both the primary and secondary Cisco Unity servers.

The Permissions wizard will complete in under an hour, and possibly in just a few minutes.

The following procedure grants the installation and services accounts the rights to act as a part of the operating system, to log on as a service, and to log on as a batch job, and does so in the local security policy. (For a complete list of the permissions set by Permissions Wizard, refer to the Permissions Wizard Help file PWHelpPermissionsSet_<language>.htm.)

To Run the Cisco Unity Permissions Wizard


Step 1 If a domain security policy is in effect, confirm that the domain security policy does not deny the installation and services accounts the rights to act as a part of the operating system, to log on as a service, and to log on as a batch job.

Step 2 Log on to the Cisco Unity server by using an account that is a member of the Domain Admins group.


Caution If you try to run the Permissions wizard by using an account that has less than the default permissions for a Domain Admin, the wizard may not be able to set all of the permissions required by the installation account and the services accounts. If the Permissions wizard cannot set all of the required permissions, either the Cisco Unity installation will fail or Cisco Unity will not run properly after it has been installed.

Step 3 On Cisco Unity DVD 1 or CD 1, browse to the Utilities\PermissionsWizard directory, and run PermissionsWizard.exe.

Step 4 On the Welcome to the Cisco Unity Permissions Wizard page, click Microsoft Exchange 5.5.

Step 5 Click Next.

Step 6 On the Installation Account page, click Change, and choose the account that you want to use to install Cisco Unity.

Step 7 Click Next.

Step 8 On the Directory and Message Store Services Account page, click Change, and choose the account that you want Cisco Unity directory and message store services to log on as.

Step 9 Click Next.

Step 10 The Verify Permission Assignments page appears, listing the permissions that will be granted to each account. The information listed includes user rights and membership in groups. Click Next to grant the listed permissions.

Step 11 If the Permissions wizard failed to grant one or more permissions, an error message appears that lists the number of permissions it was not able to grant. Click OK.

Step 12 To display a report listing the operations that succeeded and those that failed, if any, click View Detailed Results.

Step 13 If one or more permissions could not be granted, fix the problems, and run the Permissions wizard again.


Caution If the Permissions wizard failed to set any permissions, either the Cisco Unity installation will fail or Cisco Unity will not run properly after it has been installed. You must successfully run the Permissions wizard before you can continue installing Cisco Unity.

Step 14 Click Finish.

Step 15 If the account that you logged on with in Step 2 is also the account that you want to use to install Cisco Unity (the account that you selected in Step 6), log off of Windows so the permissions set by the Permissions wizard will take effect.


Setting Required Exchange Permissions

In general, the Cisco Unity Permissions wizard does not set Exchange permissions, so they must be set manually. You set the Services Account Administration permissions for the Cisco Unity installation account and for the directory and message store services account.

Do the following procedure for the installation account first, then for the directory and message store services account. Note that you set Exchange permissions only on the primary Cisco Unity server.

To Grant Services Account Administration Permissions to the Installation and Cisco Unity Directory and Message Store Services Accounts


Step 1 Log on to an Exchange server in the site that the Cisco Unity server will be joining by using an Exchange Services Account Administration account.

Step 2 On the Windows Start menu, click Programs > Microsoft Exchange > Microsoft Exchange Administrator.

Step 3 In the tree, click the site name.

Step 4 On the File menu, click Properties.

Step 5 Click the Permissions tab.

Step 6 Click Add.

Step 7 Under List Names From, click the Cisco Unity server domain.

Step 8 When you are granting permissions for the installation account, in the list of names, select the account.

When you are granting permissions for the directory and message store services account, in the list of names, select the account that Cisco Unity directory and message store services log on as.

Step 9 Click Add.

Step 10 Click OK to close the Add Users and Groups dialog box.

Step 11 Under Roles, click Service Account Admin.

Step 12 Click OK to close the Properties dialog box.

Step 13 In the left pane, under the name of the site, click Configuration.

Step 14 On the File menu, click Properties.

Step 15 Click the Permissions tab.

Step 16 Click Add.

Step 17 Under List Names From, click the Cisco Unity server domain.

Step 18 When you are granting permissions for the installation account, in the list of names, select the account.

When you are granting permissions for the directory and message store services account, in the list of names, select the account that Cisco Unity directory and message store services log on as.

Step 19 Click Add.

Step 20 Click OK to close the Add Users and Groups dialog box.

Step 21 Under Roles, click Service Account Admin.

Step 22 Click OK to close the Properties dialog box.

Step 23 Repeat Step 3 through Step 22 for the account that Cisco Unity directory and message store services log on as.

Step 24 Restart the Exchange server so the changes take effect.