Moving Roles

Single Server Mode

In order to retain a single server mode setup by keeping the Management Server, Instance Host and Client Access Server on a single server, follow the instructions below. If only one of the roles in a single server mode setup should to be moved to another server, refer to corresponding section under Multi Server Mode in this article.

• The following only applies if MFA has been enabled for some or all system administrators:

  • Log in at the Management Console and disable MFA for all administrators that have it enabled.
    The MFA secret, that is used to generate MFA codes, is stored DPAPI-protected in the management database. When the management database is transferred to a different machine, the secret cannot be decrypted on that machine and manual editing of the database would be required, which should be avoided.

• Start the MailStore Service Provider Edition Configuration tool on a server that is a Management by double-clicking it's desktop icon. On Windows Server Core use the command line prompt to start the executable (default: %PROGRAMFILES%\MailStore Infrastructure\MailStoreInfrastructureConfig.exe.
• Stop the Client Access Server, Instance Host, and Management Server services.
• Transfer your MailStore SPE license to the new server through our license portal.
• Install MailStore Service Provider Edition on the new server and set it up Single Server Mode.
• Stop the Client Access Server, Instance Host, and Management Server services on the new server.
• Remove all MailStore SPE related certificates from the server's personal (MY) certificate store of the new server.

  

• Export the SSL certificates and private keys from the old server's certificate store and import them into the same location on the new server.
  • On Windows Server 2012 R2 you can use the following PowerShell command to export all certificats stored in the computers MY store as PFX containers to the current user's desktop. That PowerShell session requires elevated privileges:
    

    (Get-ChildItem Cert:\LocalMachine\My).Thumbprint | ForEach-Object { Export-PfxCertificate -Cert ("Cert:\LocalMachine\My\{0}" -f $_) -FilePath ("$env:USERPROFILE\Desktop\{0}.pfx" -f $_) -Password  (ConvertTo-SecureString -AsPlainText -Force "not_secure_234") }

  • Windows Server 2012 R2 Powershell command to import the previously exported certificates from the current user's desktop into the new server's certificate store. That PowerShell sessions requires elevated privileges:
    

    Get-ChildItem -Path $env:USERPROFILE\Desktop\ -Filter *.pfx | Import-PfxCertificate -Exportable -Password  (ConvertTo-SecureString -AsPlainText -Force "not_secure_234") -CertStoreLocation Cert:\LocalMachine\My

• Remove the %program files%\MailStore Infrastructure\config directory on the new server and replace it with the config directory from the old one.
• Transfer your instance data directories to the new server. If the instance data on the new server is stored in a different location than on the old one, the Base Directory of the instances must be adjusted accordingly. Refer to Instance Management for further details.
• When the host name of the server has changed, also follow the instructions in Renaming the Server
• Start the Management Server service followed by the Instance Host and Client Access Server service.
• Log on to the Management Console and check the dashboard for the connection status of servers and roles.
• Re-enable Multi-Factor Authentication for system administrators that had it enabled.

Multi Server Mode

Moving the Management Server

• The following only applies if MFA has been enabled for some or all system administrators:

  • Log in at the Management Console and disable MFA for all administrators that have it enabled.
    The MFA secret, that is used to generate MFA codes, is stored DPAPI-protected in the management database. When the management database is transferred to a different machine, the secret cannot be decrypted on that machine and manual editing of the database would be required, which should be avoided.

• Start the MailStore Service Provider Edition Configuration tool on the server that has the Management Server role by double-clicking its desktop icon. On Windows Server Core use the command line prompt to start the executable (default: %PROGRAMFILES%\MailStore Infrastructure\MailStoreInfrastructureConfig.exe.
• Stop the Management Server service.
• Transfer your MailStore SPE license through our license portal.
• Install the MailStore Service Provider Edition on the new server and set it up in Multi Server Mode
• Add the Management Server role on the new server, but do not start it yet.
• Transfer the file MailStoreManagementDatabase.json from the old server's configuration directory to the same location on the new server. By default, this file resides in %programfiles\MailStore Infrastructure\config%.
• Start the Management Server service on the new server.
• Adjust the Management Server setting in the configuration of each Instance Host and Client Access Server by clicking on the corresponding Configure... button in the MailStore Service Provider Edition Configuration tool.
• Log on to the Management Console and check the dashboard for the connection status of servers and roles.
• Re-enable Multi-Factor Authentication for system administrators that had it enabled.
• System administrator credentials of administrators, that have MFA enabled, that have been used in scripts, that connect to the Management API, need to re-create API passwords and the new API passwords have to be used in these scripts.

Moving an Instance Host

• Start the MailStore Service Provider Edition Configuration tool on a server that is a Instance Host by double-clicking it's desktop icon. On Windows Server Core use the command line prompt to start the executable (default: %PROGRAMFILES%\MailStore Infrastructure\MailStoreInfrastructureConfig.exe.
• Stop the Instance Host service.
• Install MailStore Service Provider Edition on the new server and set it up in Multi Server Mode.
• Add the Instance Host role.
• Pair with the Management Server.
• Start the Instance Host service.
• Log on to the Management Console and check the dashboard for the connection status of servers and roles.
• Follow the Moving Instances guide to move the instances to the new instance host.
• Remove the Instance Host role from the old server.
• Finally remove the instance host that still exist with the old host name.

Moving a Client Access Server

• Export the certificates, including their private keys, that are visible to the end users on the old client access server. By default these are MailStoreClientAccessServerHttp and MailStoreClientAccessServerImap, but not MailStoreClientAccessServerTcp.
• Import these certificates into the new server's personal (MY) certificate store.
• Start the MailStore Service Provider Edition Configuration tool on a server that is a Client Access Server by double-clicking it's desktop icon. On Windows Server Core use the command line prompt to start the executable (default: %PROGRAMFILES%\MailStore Infrastructure\MailStoreInfrastructureConfig.exe.
• Stop the Client Access Server service.
• Install MailStore Service Provider Edition on the new server and set it up in Multi Server Mode.
• Add the Client Access Server role.
• Pair with the Management Server.
• Adjust the certificate settings in the Configure Client Access Server Role dialog to use the imported certificates.
• Start the Client Access Server service.
• Log on to the Management Console and check the dashboard for the connection status of servers and roles.
• Remove the Client Access Server role from the old server.
• Finally remove the client access server that still exist with the old host name.