Table Of Contents
Introduction to the Cisco Unity Objects Stored in Active Directory
In the Future: Cisco Unity Sites
About the Cisco Unity Database and Active Directory
Why Cisco Unity Stores Data in Active Directory
About the Cisco Unity Schema Extensions to Active Directory
Viewing the Version of the Schema Extensions
Chronology of Changes to Schema Extensions
Changes to Extensions Required by Cisco Unity
Changes to Bridge Networking Extensions
Changes to VPIM Networking Extensions
Updates to the Directory Are Synchronous
Updates to the SQL Database Are Asynchronous
White Paper: Cisco Unity Data and Active Directory (Cisco Unity 5.x and Later with Microsoft Exchange)
Published September 17, 2007
This document describes the Cisco Unity data that is stored in Active Directory. See the following sections:
•
Introduction to the Cisco Unity Objects Stored in Active Directory—Describes the Cisco Unity objects that are stored in Active Directory.
•
•
•
•
For information about the size impact of the Cisco Unity schema extensions on Active Directory, see the White Paper: Active Directory Capacity Planning (Cisco Unity Version 5.x and Later with Microsoft Exchange), at http://www.cisco.com/en/US/products/sw/voicesw/ps2237/prod_white_papers_list.html.
For detailed information about the Active Directory permissions required by Cisco Unity, see the Permissions wizard Help file, which is available on www.ciscounitytools.com, or the file PWHelpPermissionsSet_<language>.htm on the Cisco Unity server.
Introduction to the Cisco Unity Objects Stored in Active Directory
Almost all of the information about subscriber accounts and other Cisco Unity objects is stored in a SQL database on the Cisco Unity server. However, a minimal amount of information about subscribers, distribution lists, and locations is stored in Active Directory. The following sections provide an introduction to the objects that Cisco Unity stores in Active Directory:
•
About Subscribers
Anyone who has an account on Cisco Unity is a subscriber. Each Cisco Unity subscriber account is associated with an Active Directory user with an Exchange mailbox in which Cisco Unity stores voice messages. The associated user objects for subscribers in Active Directory contain Cisco Unity-specific attributes (see Table 1).
When you create a subscriber account in Cisco Unity, the associated user object in Active Directory is created with Cisco Unity-specific attributes. You can also create subscriber accounts by importing existing users. In this case, when the subscriber account is created, the Cisco Unity-specific attributes are written to the existing user object in Active Directory.
Cisco Unity supports networking with other voice mail systems. This networking functionality includes the ability to create remote subscriber accounts for people who do not have mailboxes on the local Exchange network. You create remote subscriber accounts in Cisco Unity to allow callers to find them in the Cisco Unity phone directory, and to allow Cisco Unity subscribers to send messages to them as they would to any other subscriber. There are different types of remote subscribers: AMIS, Bridge, Internet, Trusted Internet, and VPIM. Voice messages for Internet and Trusted Internet subscribers are sent to an e-mail address that you specify when you create the subscriber account. Voice messages for AMIS, Bridge, and VPIM subscribers are sent to a mailbox on the remote voice messaging system.
When a remote subscriber is created, an associated Active Directory contact is also created. The contacts in Active Directory for remote subscribers contain Cisco Unity-specific attributes.
About Distribution Lists
A Cisco Unity public distribution list is an Active Directory group that contains Cisco Unity-specific attributes (see Table 3).
When you create a distribution list in Cisco Unity, the associated group object in the directory is created with Cisco Unity-specific attributes. You can also create distribution lists by importing existing groups. In this case, when the distribution list is created, the Cisco Unity-specific attributes are written to the existing group object in the Active Directory.
Distribution lists can contain both subscribers and non-subscribers. When a voice message is sent to a distribution list, it is delivered to the mailboxes of non-subscribers as an e-mail with a WAV attachment. Depending on the codec used to record the message, non-subscribers can use Windows Media Player or another program to listen to the voice message.
About Locations
The Cisco Unity schema extensions include the definition for a class of objects called locations. Locations are Cisco Unity objects that are used in Cisco Unity networking. (See Table 4 for a list location attributes.) There are two types of locations: primary locations and delivery locations.
Each Cisco Unity server is associated with one location object—referred to as the primary location—which is created during installation and which cannot be deleted. Each primary location contains the network information that identifies the Cisco Unity server to other Cisco Unity servers and to other voice messaging systems.
A delivery location contains the network information that Cisco Unity needs to send messages to and receive messages from other voice messaging servers. You create a delivery location for each voice messaging server with which the local Cisco Unity server will communicate. The delivery location identifies the voice messaging system to Cisco Unity.
For more information about networking in Cisco Unity, see the Networking Guide for Cisco Unity, available at http://www.cisco.com/en/US/products/sw/voicesw/ps2237/products_feature_guides_list.html.
In the Future: Cisco Unity Sites
The Cisco Unity schema extensions include the definition for a class of objects called Cisco Unity sites. Although they are not currently used, future versions of Cisco Unity may create and make use of Cisco Unity site objects. The class definition for Cisco Unity sites was added to the schema extensions in Cisco Unity 5.0(1) to avoid additional schema extensions in the future.
Although the plans are not firm yet, in the future, multiple Cisco Unity servers configured for Digital Networking could be associated with a Cisco Unity site object. Configuration settings common to all the servers could be applied to the site object instead of having to configure the same settings on each server. The use of site objects would save an administrator configuration time, and would ensure that all the servers have consistent settings.
About the Cisco Unity Database and Active Directory
Cisco Unity stores its data in an SQL database on the Cisco Unity server, and a subset of that data is also stored in Active Directory. The following sections provide more information:
•
•
•
•
Cisco Unity Database
The Cisco Unity database is a Structured Query Language (SQL)-based, scalable, relational database. Depending on your configuration, the database that Cisco Unity uses is either Microsoft SQL Server 2000 or Microsoft Data Engine 2000 (MSDE 2000)1 . (Note that the MSDE 2000 data engine is fully compatible with SQL Server.)
Cisco Unity stores its data in a database called Unitydb. Unitydb contains tables for each type of Cisco Unity object. These tables contain data about all of the Cisco Unity objects that have been created on the local Cisco Unity server. Additionally, there are global subscriber and global location tables that contain information about the subscriber accounts and locations that were created on other Cisco Unity servers. When subscriber accounts and location objects from other servers replicate in Active Directory, Cisco Unity detects these objects and saves information about them in the global tables.
You use the Cisco Unity Administrator and tools such as Bulk Edit to make changes to the data that is stored in Unitydb. You can also use the Cisco Unity Data Link Explorer (CUDLE), found in Tools Depot, to view the raw data in Unitydb. Although you can also use the standard database tools on the Cisco Unity server to run SQL queries on the tables, you should not change values directly in the database. In particular, do not add or delete tables, and do not add or delete columns from the tables in the Unitydb.
Note that recorded voice names and greetings are stored in files on the Cisco Unity server (in the \CommServer\StreamFiles directory) and not in the SQL database.
Why the SQL Database Is Used
Storing Cisco Unity data in a SQL database has the following benefits:
•
•
•
•
Why Cisco Unity Stores Data in Active Directory
Because there is a SQL database on the Cisco Unity server, it may not be clear why any Cisco Unity objects are stored in Active Directory. At first glance, it seems to add complexity, because of the need to keep two data stores synchronized. While this is a valid concern, there are three main reasons for storing information in Active Directory:
•
•
•
Support for Unified Messaging
Cisco Unity provides true Unified Messaging: voice messages are stored along with e-mails and faxes in the Exchange mailbox store. Cisco Unity uses the Exchange message transfer agent to route voice messages to subscribers. Because of the reliance on Exchange, some information about subscribers and distribution lists must be stored in Active Directory to support Unified Messaging.
Cisco Unity needs access to Active Directory user account information and/or the associated Exchange mailboxes in order to:
•
•
•
•
•
Support for Networking
In organizations with two or more Cisco Unity servers in the same Active Directory forest, subscribers are served by the Cisco Unity server on which their accounts were created. In Cisco Unity, "networking" is the general term for messaging between Cisco Unity servers, and between Cisco Unity and other voice messaging systems. The term networking has a broad definition and encompasses the following ideas:
•
–
–
–
•
By storing all the attributes for primary and delivery location objects in Active Directory, the addressing information that Cisco Unity needs for messaging between other Cisco Unity servers and other voice messaging systems replicates to all Cisco Unity servers in the Active Directory forest.
In order to address messages to subscribers who are associated with another Cisco Unity server, each server in the network needs access to some subscriber attributes such as the location with which the subscriber is associated and the subscriber extension. These subscriber attributes (and others) are stored in Active Directory so that they replicate to all Cisco Unity servers on the network. Cisco Unity stores this replicated data in a table for global subscriber data in the SQL server.
Like other voice messaging systems, Cisco Unity allows subscribers to record their names. A subscriber must have a recorded name in order to be listed in Cisco Unity phone directory. The recorded name is played when outside callers use the phone directory to look up a subscriber extension by pressing keys on the phone to spell part of the recipient name ("For John Smith at extension 5512, press 1; for Jane Smith at extension 5591, press 2."). To allow outside callers to look up a subscriber in the phone directory no matter which Cisco Unity server the subscriber is associated with, the recorded name must be stored in Active Directory so that it replicates to the other Cisco Unity servers.
Similarly, when subscribers use the phone to address messages, the recorded name is played so that the subscribers can confirm that the extension they entered is correct. To provide voice name confirmation to subscribers when they address messages over the phone to subscribers on other Cisco Unity servers, the recorded name must be in the directory.
Before Cisco Unity is installed, the Active Directory schema is extended to store the Cisco Unity-specific information. To support the Cisco Unity Bridge or VPIM networking options, the schema must be further extended to store information needed by Bridge and VPIM delivery location objects.
Flexible Administration
Because information is stored in Active Directory, Cisco Unity allows for flexible administration of subscribers and distribution lists. You can create subscriber accounts and distribution lists by using the Cisco Unity Administrator, which is a Web-based interface to all Cisco Unity data. When creating a subscriber, external subscriber, or distribution list, Cisco Unity creates the corresponding user, contact, and group automatically; it is not necessary to first create the directory objects by using the standard Microsoft tools.
In addition, if the directory objects already exist, they can be imported into Cisco Unity. For example, if your organization has an existing directory of Exchange users, these users can be imported into Cisco Unity. When the user data is imported, the Cisco Unity-specific data is added to the user accounts. You can then use the Cisco Unity Administrator to view and modify the subscriber accounts as needed.
However, if you delete a subscriber or distribution list in the Cisco Unity Administrator, the objects are not deleted from Active Directory, for security reasons. Instead, only the Cisco Unity-specific attributes are deleted from the directory object. You can then use standard Microsoft tools to delete the directory object.
Because Cisco Unity synchronizes the information between the SQL database and Active Directory, if you make a change to a subscriber account in the Cisco Unity Administrator (such as changing the last name of the subscriber), this information is written to Active Directory. Similarly, if you change the last name of a user in Active Directory Users and Computers, Cisco Unity detects the change and updates the SQL database. See the "About Synchronization" section for more information.
Note
Customizable Permissions
While some organizations like the convenience of being able to create and modify Active Directory objects by using the Cisco Unity Administrator, other organizations with stringent security policies need to lock down administrative access to Active Directory. The Cisco Unity Permissions wizard allows a greater amount of control over the types of Active Directory objects that administrators can administer through Cisco Unity.
The Permissions Wizard sets only the permissions that Cisco Unity requires to function rather than setting permissions at a higher level. To simplify the setting of permissions for the Cisco Unity-specific properties, a property set that contains these individual properties—ciscoEcsbuUnityInformation—has been added to the schema. Permissions for Cisco Unity-specific attributes are set at the property set level instead of at the object level, and permissions for non-Cisco Unity-specific attributes that Cisco Unity requires access to are set at the property level.
For detailed information about the Active Directory permissions required by Cisco Unity, see the Permissions wizard Help file, which is available on www.ciscounitytools.com, or the file PWHelpPermissionsSet_<language>.htm on the Cisco Unity server.
About the Cisco Unity Schema Extensions to Active Directory
This section describes the extensions that Cisco Unity makes to the Active Directory schema. A basic understanding of Active Directory schema concepts is assumed. See the following sections for details:
•
•
•
•
Extending the Schema
Active Directory supports the use of LDAP Data Interchange Format (LDIF) scripts to extend the schema. Before installing Cisco Unity for use with an Exchange partner server, you must run a script that makes Cisco Unity-specific modifications to the Active Directory schema. To support VPIM Networking or Bridge Networking, the schema must be further extended. There are separate LDIF files for VPIM and Bridge Networking.
To extend the Active Directory schema, you run a Cisco Unity utility called ADSchemaSetup. The utility applies the schema extensions specified in the LDIF script files located on Cisco Unity DVD 1 and CD 1 in the directory Schema\LdifScripts. The user interface for ADSchemaSetup.exe consists of a dialog box with check boxes that correspond to the LDIF script files, as shown in Figure 1.
Figure 1 Active Directory Schema Setup Interface
The LDIF files have changed among Cisco Unity versions as needed to provide additional features and functionality, as described in "Chronology of Changes to Schema Extensions" section.
Note
All Cisco Unity attributes added by avdirmonex2.ldf, omnigateway.ldf, and vpimgateway.ldf are replicated in the Global Catalog server. These are the attributes marked with "ismemberofpartialattributeset = TRUE" in the script files.
Attributes with the "searchFlags" property set to a non-zero number are indexed.
Viewing the Version of the Schema Extensions
Each time changes are made to an LDIF script, the script is updated to write a new version description. The updated description will be added to the existing description rather than replacing it so that there is a history of the schema extensions that have been applied.
See the following procedures for instructions for viewing the schema version:
•
•
To View the Version of the Schema Extensions on the Server on Which ADSchemaSetup Was Run
Step 1
This folder contains subfolders that are named based on the date on which ADSchemaSetup was run.
Step 2
This folder contains a separate folder for Avdirmonex2k.ldf (Cisco Unity schema extensions), Omnigateway.ldf (Cisco Unity Bridge extensions), and Vpimgateway.ldf (VPIM extensions).
Step 3
Step 4
Step 5
Step 6
•
•
•
Note that the version displayed is the Cisco Unity version when the LDIF file was last modified, which may be older than your Cisco Unity version.
The following example shows two parts of an ldif.log file for the Avdirmonex2k.ldf extensions for a server that was installed using a version 4.2(1), and then upgraded to 5.0(1):
51: CN=cisco-Ecsbu-UM-Schema-Version,CN=Schema,CN=Configuration,DC=Media,DC=cisco-uty-123456,DC=cisco,DC=comEntry DN: CN=cisco-Ecsbu-UM-Schema-Version,CN=Schema,CN=Configuration,DC=Media,DC=cisco-uty-123456,DC=cisco,DC=comchange: modifyAttribute 0) Description:Unity 4.2Attribute or value exists, entry skipped....106: CN=cisco-Ecsbu-UM-Schema-Version,CN=Schema,CN=Configuration,DC=Media,DC=cisco-uty-123456,DC=cisco,DC=comEntry DN: CN=cisco-Ecsbu-UM-Schema-Version,CN=Schema,CN=Configuration,DC=Media, DC=cisco-uty-123456,DC=cisco,DC=comchange: modifyAttribute 0) Description:Cisco Unity 5.0Entry modified successfully.To View the Version of the Schema Extensions by Using ADSI Edit
If you do not know the server on which ADSchemaSetup was run, or if you do not have access to the server, you can use the Microsoft utility, ADSI Edit, to view the contents of the attribute cisco-Ecsbu-UM-Schema-Version. ADSI Edit comes with Cisco Unity and also comes with Windows 2000 Support Tools. ADSI Edit can be run on a Cisco Unity server or any server in the domain.
Note
Caution
Step 1
regsvr32 adsiedit.dll
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
•
Unity Bridge <version>•
Unity VPIM <version>•
Unity <version>Note that the version displayed is the Cisco Unity version when the LDIF file was last modified, which may be older than your Cisco Unity version.
Classes
The Cisco Unity schema extensions contain the following classes:
•
•
–
–
–
•
–
–
–
Although the ciscoEcsbuUMAttributes auxiliary class was added to users, contacts, groups, and locations, currently, users are the only objects that contain data.
Property Sets
The property set ciscoEcsbuUnityInformation was added to accommodate changes to the Cisco Unity Permissions wizard. In general, permissions for ciscoEcsbu... attributes in Active Directory are granted on the ciscoEcsbuUnityInformation property set, not on the individual attributes.
For a complete list of the attributes that appear in the property set and the type of object to which each attribute applies, refer to the section "Attributes in the ciscoEcsbuUnityInformation Property Set" in the Permissions wizard Help file, which is available on www.ciscounitytools.com, or on the Cisco Unity server.
Attributes
This section lists the attributes that Cisco Unity adds to users, contacts, groups, and locations.
User and Contact Attributes
•
•
Table 1 User and Contact Attributes in Active Directory
Alternate Extensions
ciscoEcsbuAlternateDtmfIds
Multi-valued collection of unique alternate DTMF access codes that callers can dial to access the Cisco Unity subscriber that is associated with this user or contact.
AMIS Disable Outbound
ciscoEcsbuAmisDisableOutbound
For an AMIS subscriber, indicates no messages are being delivered to this target.
Extension
ciscoEcsbuDtmfId
Primary unique DTMF access code that callers can dial to access the Cisco Unity subscriber that is associated with this user or contact.
List In Phone Directory
ciscoEcsbuListInUMDirectory
List the subscriber in the phone directory for outside callers.
Call Transfer String
ciscoEcsbuTransferId
The primary call handler contact rule transfer string for the subscriber, accessed by directory handlers when doing searches on remote Cisco Unity servers in the same dialing domain and for automated attendant transfers.
Location Object ID
ciscoEcsbuUMLocationObjectId
Identifies the location with which the subscriber is associated.
Undeletable
ciscoEcsbuUndeletable
If true, this object cannot be deleted by using the Cisco Unity Administrator or other tools (used to prevent deletion of factory defaults).
Recorded Voice Name
msExchRecordedName2
The recorded name of the subscriber.
Object Type
ciscoEcsbuObjectType
Cisco Unity enumeration for type of object.
Order of Alternate Extensions
ciscoEcsbuAlternateDtmfIdsOrder
Used to determine the order of the alternate DTMF ids.
Message Security Encryption Setting
ciscoEcsbuUnityAttributes
Used to store the secure messaging encryption setting on user objects. If needed in future Cisco Unity versions, additional data can be stored in this attribute.
N/A
ciscoEcsbuUnityAttributesIndexed
Not currently used.
N/A
ciscoEcsbuUnityAttributesEncoded
Not currently used.
1 Cisco Unity attribute names vary slightly depending on the tool that you use to view the attributes. For example, the "List in Directory" attribute above has the following names: "ListInDirectory" is the column name when using SQL Enterprise Manager to view the Subscriber table in the Unitydb database; "AVP_LIST_IN_DIRECTORY" is the object property name when using the DohPropTest tool; "List in phone directory" is the field name on the Subscriber > Profile page in the Cisco Unity Administrator.
2 Cisco Unity extends the schema with and uses msExchRecordedName by written permission of the Microsoft Corporation.
For regular and Internet subscribers, the Location Object ID is the Object ID of the primary location. For AMIS, Bridge, and VPIM subscribers, the Location Object ID is the Object ID of the delivery location with which the subscribers are associated.
Distribution List Attributes
The Cisco Unity-specific attributes shown in Table 3 are added to Active Directory groups.
Table 3 Distribution List Attributes in Active Directory
Extension
ciscoEcsbuDtmfId
Primary unique DTMF access code that callers can dial to access the Cisco Unity Distribution List that is associated with this distribution list.
Location Object ID
ciscoEcsbuUMLocationObjectId
Identifies the location that the distribution list was created on.
Undeleteable
ciscoEcsbuUndeletable
If true, this object cannot be deleted by using the Cisco Unity Administrator (used to prevent deletion of factory defaults).
Voice Enabled
ciscoEcsbuVoiceEnabled
Set when the distribution list is enabled for voice.
Alias
mailNickname
Mail name of the distribution list.
Recorded Voice Name
msExchRecordedName1
Distribution List recorded name.
Object Type
ciscoEcsbuObjectType
Cisco Unity enumeration for type of object.
N/A
ciscoEcsbuUnityAttributes
Not currently used.
N/A
ciscoEcsbuUnityAttributesIndexed
Not currently used.
N/A
ciscoEcsbuUnityAttributesEncoded
Not currently used.
1 Cisco Unity extends the schema with and uses msExchRecordedName by written permission of the Microsoft Corporation.
Location Object Attributes
•
•
•
Table 4 Location Object Attributes in Active Directory
Addressing Max Scope
ciscoEcsbuAddressingMaxScope
Used to indicate the type of addressing that is supported by this location (local, dialing domain, global).
Allow Blind Addressing
ciscoEcsbuAllowBlindAddressing
If true, messages can be addressed to this location without an existing handler or mail user.
AMIS Delivery Phone Number
ciscoEcsbuAmisDialId
Corresponds to the AMIS dial ID on the Delivery Location page in the Cisco Unity Administrator.
AMIS Node Active
ciscoEcsbuAmisNodeActive
True if the node is active.
AMIS Node ID
ciscoEcsbuAmisNodeId
Identifier for the AMIS Node.
Blind Addressing Max Scope
ciscoEcsbuBlindAddressingMaxScope
Scope of blind addressing search.
Destination Type
ciscoEcsbuDestinationType
Indicates the destination type for the location (SMTP, AMIS, VPIM, Bridge).
Dialing Domain Name
ciscoEcsbuDialingDomainName
Name of the dialing domain for networking.
Location Dial ID
ciscoEcsbuDtmfId
Primary unique DTMF access code that callers can dial to access the Cisco Unity Location.
Include Locations
ciscoEcsbuIncludeLocations
If set on the primary location, the Cisco Unity conversation will include locations in search results.
SMTP Domain
ciscoEcsbuUMDomain
For the primary location, the domain name that the remote voice messaging system uses when addressing messages to Cisco Unity subscribers. Corresponds to the SMTP Domain Name field on the Primary Location page in the Cisco Unity Administrator.
For a VPIM or SMTP delivery location, the domain name that Cisco Unity uses when addressing messages to subscribers on the remote voice messaging system. Corresponds to the SMTP Domain Name field on the Delivery Location page in the Cisco Unity Administrator.
For an AMIS delivery location, the phone number used to reach the remote AMIS system. Corresponds to the Delivery Phone Number field on the Delivery Location page in the Cisco Unity Administrator.
Domain ID
ciscoEcsbuUMDomainId
Not currently used.
Location Object ID
ciscoEcsbuUMLocationObjectId
The unique identifier for this location object.
System ID
ciscoEcsbuUMSystemId
Used to identify the Cisco Unity system on which this location was created.
Schema Version
ciscoEcsbuUMSchemaVersion
The version of schema extensions that has been applied. (Note that the version displayed is the Cisco Unity version when the LDIF file was last modified, which may be older than your Cisco Unity version.)
Undeletable
ciscoEcsbuUndeletable
If true, this object cannot be deleted by using the Cisco Unity Administrator (used to prevent deletion of factory defaults).
Display Name
displayName
Spelled name.
Alias
ciscoEcsbuDirectoryAlias
Unique text name for this object.
Recorded Voice Name
msExchRecordedName1
Location recorded name.
Object Type
ciscoEcsbuObjectType
Cisco Unity enumeration for type of object.
Home Server
ciscoEcsbuUMServer
The Cisco Unity server which owns this location.
System State
ciscoEcsbuUMSystemState
(Added in Cisco Unity 4.0(1).)Licensing information for the Cisco Unity server that is associated with this location. Only present on non-delivery locations.
N/A
ciscoEcsbuUnityAttributes
Not currently used.
N/A
ciscoEcsbuUnityAttributesIndexed
Not currently used.
N/A
ciscoEcsbuUnityAttributesEncoded
Not currently used.
AVP_OPTION_FLAGS
ciscoEcsbuOptionFlags
A bit mask that controls various options including the secure messaging encryption settings on delivery locations.
1 Cisco Unity extends the schema with and uses msExchRecordedName by written permission of the Microsoft Corporation.
Chronology of Changes to Schema Extensions
This section summarizes the changes to the Active Directory schema extensions and the version of Cisco Unity when the changes occurred. Changes to the schema are always backwards compatible with earlier version of Cisco Unity. See the following sections:
•
•
•
Changes to Extensions Required by Cisco Unity
Table 7 provides a chronology of the schema extension changes in the LDIF script file name Avdirmonex2k.ldf, which corresponds to the ADSchemaSetup check box called "Directory Monitor."
Changes to Bridge Networking Extensions
Table 8 provides a chronology of the schema extension changes in the LDIF script file name Omnigateway.ldf, which corresponds to the ADSchemaSetup check box called "Bridge Connector."
Changes to VPIM Networking Extensions
Table 9 provides a chronology of the schema extension changes in the LDIF script file name Vpimgateway.ldf, which corresponds to the ADSchemaSetup check box called "VPIM Connector."
About Synchronization
Cisco Unity includes directory monitors that keep the Cisco Unity objects in the directory synchronized with the SQL database on the Cisco Unity server. In addition to monitoring Active directory for changes, the monitors also work in the other direction, and write changed information from Cisco Unity to Active Directory. Note that the changes that Cisco Unity makes to Active Directory depends on the permissions set in the Permissions wizard.
There are two Active Directory monitors: one monitors changes to Cisco Unity objects that are associated with the local server, and the other monitors the Active Directory global catalog for changes to objects that are associated with other Cisco Unity servers.
See the following sections for more detailed information about synchronization:
•
•
For information on the attributes that are synchronized in Active Directory, refer to the Permissions wizard Help file, which is available on www.ciscounitytools.com, or the file on the Cisco Unity server called PWHelpPermissionsSet_<language>.htm. Note that in the lists of attributes, a "W" indicates that Cisco Unity writes data to the attribute, and a "R" means that Cisco Unity reads the data in the attribute. In most cases, when Cisco Unity does a read, it updates data in the Unitydb database, but in some cases, Cisco Unity reads the data to perform some operation, and does not store the data.
Updates to the Directory Are Synchronous
Changes to subscriber accounts, distribution lists, and location objects made by using the Cisco Unity Administrator (or another Cisco Unity application) are written to the directory when the change occurs, so that both the SQL database and the directory remain consistent, as Figure 2 illustrates.
The changes made to the directory depend on the action in the Cisco Unity application: create, import, modify, or delete.
•
•
•
•
When location objects are deleted by using the Cisco Unity Administrator, the location objects are deleted from both the SQL database and the directory.
Figure 2 Updates to the Directory Are Synchronous
Updates to the SQL Database Are Asynchronous
Every few minutes the directory monitor polls for new, changed, and deleted objects and then queues the detected changes. The changed information is pulled from the queue and written to the SQL database. Figure 3 illustrates this process.
Figure 3 Updates to the SQL Database Are Asynchronous
Active Directory Monitors
The Active Directory monitors run as services on the Cisco Unity server. Both Active Directory domain controller (DC) databases and global catalog (GC) databases are polled for changes. There are two monitors:
•
Changes to Active Directory objects that appear on a DC that AvDSAD is monitoring will be reflected in Cisco Unity within the two-minute polling interval. If a change to an object occurs on a DC that AvDSAD is not monitoring, the change first has to be replicated to the monitored DC. In this case, the time that it takes for the change to be reflected in Cisco Unity depends on your network configuration and replication schedule.
•
In order for changes to objects associated with other Cisco Unity servers to be reflected, the changes first have to be replicated to the Active Directory global catalog, and then the monitor can detect the changes. The time that it takes for changes to be reflected in the global catalog depends on your network configuration and replication schedule.
All directory objects have an attribute called uSN-Changed, which contains the update sequence number (USN). Whenever an object is changed, uSN-Changed is updated to be the highest number (plus one) of all the objects in the directory. For example, assume the uSN_Changed of object A is 100, the uSN-Changed of object B is 101, and the uSN-Changed of object C is 102. In this case, when a change is made to object A, its uSN-Changed is updated to 103. Each time the monitors perform a synchronization cycle, they store the highest USN encountered during the synchronization.
During synchronization, the monitors query the DC and GC databases (as applicable) to obtain a list of objects. The monitors filter out all non-Cisco Unity objects. By comparing the LastUSN to the current USN of each object, all objects that have not changed since the last polling (that is, objects with a uSN-Changed value that is less than LastUSN) are filtered out of the list.
If the monitors encounter an error while synchronizing an object, the synchronization cycle is aborted, and the LastUSN value is not updated. Updates to SQL are not performed for the object on which the error was encountered and for subsequent objects on the list. When the next synchronization occurs, because LastUSN was not updated, the list of objects to be updated is the same as in the previous synchronization.
When a change is detected, the monitor sends a notification by using Microsoft Message Queue (MSMQ). The notification specifies whether the object has been changed or deleted, and whether the change has been detected in the DC or in the GC. The notification includes the value of each object property that is used by Cisco Unity. In case of conflict, changes to an object made by using the Cisco Unity Administrator take precedence over changes detected in Active Directory.
The monitor uses a table called ADMonitorDirObjsList in the SQL database that associates each object used by Cisco Unity with the domain in which it resides. Additionally, the monitor uses a table called ADMonitorDistributionListMember in the SQL database that associates each distribution list used by Cisco Unity with the members of the list.
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2007 Cisco Systems, Inc. All rights reserved.
1 At the time of this writing, SQL Server 2005 is not supported, but it may be supported in future Cisco Unity versions.
Guest
