Concerns about Unity AD extensions

[cory-gray]

Hello,

I am installing a Unity server into a Microsoft 2000 network. All of the DC's and an exchange server are all Win2k. I am very nervous about installing unity becasue of the schema modifications. If the schema gets hosed, then the entire network would crash. Is there anyway to gauruntee that installing Unity in this environment will not crash the domain? Is there anything I should be aware before proceeding? I already know the Exchange service packs that must be applied. Is there any service packs on the DC's that should be applied? What are potential failures and problems? I need information. Any input is greatly appreciated.

Thanks,

[lindborg]

First, posting something with a title like "Unity crashing an entire wind2K AD network" is dirty pool - that's clearly not what's happening, you just want reassurances that it wont. I'll edit your posting title on your behalf with a little more reasonably worded title here in a second...

second, all our schema extensions are tested and approved by (and registered with) Microsoft - You can view the registration by typing in Cisco-ECSBU at:

http://msdn.microsoft.com/certification/ADAcctInfo.asp

Third, we've done literally thousands of such extensions and installations of Unity 3.x and later and have never (I repeat never) "crashed an entire win2K AD network" or caused any other problems in AD for that matter.

[cory-gray]

I’m sorry you didn’t agree with the title of my posting. If possible, can you answer the questions I asked? Mainly, the question… “What are potential failures and problems?”

Thanks,

[lindborg]

I'm unsure how exactly you want me to respond to that - we (and Microsoft and a lot of other folks) test the schema extensions extensively - there are no failures or problems encountered.

if the account you're running the schema extension tool with has rights to extend the schema this should go through smooth.

Asking me to speculate on what could possibly go wrong is kind of a tough thing to respond to here.

[kechambe]

Just to echo Jeff's comments...

I work on the voice escalation team in TAC and focus on Unity. To the best of my knowledge there has **NEVER** been an issue where our schema extension has caused damaged to a customers directory.

Keith

[#6]

We have a serious concern about implementing a Unity in our AD infrastructure (1000 users).

What is the impact on the long term. I was said the UID used by the product installation in not registered at Microsoft ! Is that true ?

We do not have a login on the Microsoft URL you mentionned above. Can you give me one or send me the document by E-mail ? (jfa@ubp.ch)

Thanks

Jean-Philippe

[Ginger Dillon]

Hi -

Some input from the customer side. We installed the schema updates into a lab environment that mirrored our AD infrastructure - single forest, single Exchange organization with multiple domains and administrative groups. We are one department running Unity unified messaging with 2500 employees in a government organization of approximately 12,000 employees. We likewise tested the schema updates in an enterprise lab environment before installing them into production. We created a document that discusses how to install in a test lab environment, if you are interested in a copy, email me separately. However, Cisco has some of its own excellent documents on the subject - these are really good references!

http://www.cisco.com/en/US/customer/products/sw/voicesw/ps2237/products_implementation_design_guide_chapter09186a00801187c6.html

http://www.cisco.com/en/US/customer/products/sw/voicesw/ps2237/products_white_paper09186a00800e4535.shtml

Sincerely,

Ginger

[kechambe]

To answer your question, no that is not true. The OID is registered with Microsoft.

I fully appreciate our products being scrutinized before deployment but this thread is sounding like a witch-hunt to me. There aren’t any pointed questions here with data that supports them that explain exactly what people are concerned with.

I understand that folks will always fear the unknown but it’s been 3 years since Unity 3.0 shipped and again, we have never damaged a customer’s schema.

Cisco has done its due diligence in regards to the Unity schema modifications:

Our schema extensions are registered with Microsoft. Click on the link and type Cisco-ECSBU:

http://msdn.microsoft.com/certification/ADAcctInfo.asp

They are also registered with IANA site under decimal 5771:

http://www.iana.org/assignments/enterprise-numbers

I am also attaching the Directory Monitor LDIF file to this post so that people can review it.

Again, I understand that people are concerned with modifying their schema. What Ginger has done is a great example of the proper way to go about testing our schema extensions. I think it is great that we can have this discussion but lets keep the questions factual and not speculative.

Thanks,

Keith

[cory-gray]

I am the one who started this discussion. I installed Unity 4.0(3) into the customers network. The schema modifications were fine. I really believed that the schema modifications would be no problem, but you must understand there is a GREAT liability issue here if something was to go wrong. Until this post I couldn't find a straight answer as far as the potentiall issues. The documentation links that have been provided on this discussion would have stopped me from starting the controversy.

Thanks everyone for their input!

[jdiegmueller]

I find it ironic that Systems folks are often so adamantly against Schema extensions.

What's the point of a directory if you can't use it to store the data you want stored?

What's the point of a directory vendor offering the ability to extend the schema if you're scared to leverage it?

Most of the time, people can't even cite what it is they are scared of. This thread ("I am afraid it will crash the network"; huh?) is a strange echo of concerns I've heard from other customers in the past.

Food for thought, although insight in to this strange directory fear people have is welcomed.