Migrating from HCL Notes (Lotus Notes / IBM Domino)

 

Logging into the Notes Client - You must log into the Notes client on all servers where the migration will run when logged into the server as the specified Windows User and with the Notes Administrator username and password. Note Client should be closed after logging in. Failure to do this will result in permission issues when opening the Notes ID file.

 

Destination prerequisites for Google Workspace

You will need:

• Access to the Developers console in the Google tenant
• console.cloud.google.com/ 
• The email address of a primary Google Workspace domain administrator account for your destination domain.
• To set up a Service Account and P12 keys, and enable the correct Google APIs, for the Google Destination domain (as described in the Setting up the Service Account and enable the APIs within Google Workspace for CloudM Migrate section below).
• The email address of a test account in the destination that can be used for testing.
• The names of the primary or secondary domain that you are migrating to / from.

 

Setting up the Service Account and enable the APIs within Google Workspace for CloudM Migrate

The following Google Service Account setup methods are for both a source Google Workspace account and a Destination Google Workspace account. 

Use either the:

• Automated process using Powershell script (Recommended), or
• Manual process using GCP

Automated Process (Recommended method)

This method uses a Powershell script to automate the majority of the process, making sure that the correct Scopes and APIs are applied, with only a few simple manual steps required.

It is easier and quicker than the full manual process, and less prone to error.

Before you start, you will need:

• An account in GCP with permissions to create a project (resourcemanager.projects.create role) or owner on existing project,
• The ability to run Powershell Script as Administrator,
• A browser window open and authenticated into the GCP tenant. This must be the last browser tab you have used.

 

To create a service account and obtain the private key for the account:

1. Install Google Cloud SDK using the instructions provided by Google here,
2. Once Google Cloud SDK has finished installing, download the GCP_Configuration.ps1 file to your desktop,
3. Click on your Desktop Search icon (next to the Start Icon) and search for Windows Powershell
4. Select Run as Administrator
5. On the GCP_Configuration.ps1 file, select Shift and right click. Select Copy as Path.
6. In the Windows Powershell window, enter CD and a space, then press the up arrow key on your keyboard until you see the first half of the file path and select enter. It will look similar to: 

• • CD C:\Users\(your name)\Desktop

7. On the next line, press the up arrow key on your keyboard until you see & ‘.\GCP_Configuration.ps1 and press enter.
• If you see a security error that the Powershell Script is unsigned, run “Set-ExecutionPolicy Restricted”.
8. On the Project ID line, enter a unique Project ID name.
9. On the Service Account ID, enter a Service Account name. It can be the same as the Project ID name.
10. On the Scope line, enter one of the following to specify the scopes to be assigned:
• All (for Full scopes) - Recommended for Google to Google
• Standard
• SourceLimited
• DestinationLimited
• Vault
• Storage

11. The Powershell script will run, setting up the service account and enabling the scopes. This may take a few minutes to complete.
12. Once the Powershell has finished, you will need to manually complete a few easy steps (Steps 1 to 4 as detailed below) to complete the OAuth and Domain Wide Delegation configuration, with instructions and URLs displayed.
13. For Step 1 - Configure OAuth Consent, copy the displayed URL and paste into a browser. Sign in to GCP with a full admin account. 
14. On the OAuth consent screen, set the User Type to Internal and select Create.
15. On the next screen, set the App name to CloudM Migrate, and add a User Support email and a Developer Contact email address.
16. Select Save and Continue.
17. For Step 2 - Configure Google Workspace Domain Wide Delegation using the following ClientId and Scopes, copy the displayed URL in the Powershell window and paste into a browser.
18. On the Security > API Controls > Domain-wide Delegation screen, select Add new to display the Add a new client ID pop-up box.
19. Copy and paste the Client ID and OAuth Scopes from the Powershell window into the specified fields and select AUTHORIZE.

20. Now, from the Step 3 - Service Account details for use in CloudM Migrate section of the Powershell script, copy the Service account email address that you need later when configuring the platform in CloudM Migrate.
21. The P12 file that you will also need when configuring the platform in CloudM Migrate can be found in C:\CloudM\GCPConfig, along with a gcp_config log for the process.

Manual Process

To create a service account and obtain the private key for the account

1. Open a web browser and sign in as an administrator for the required platform.
2. Go to cloud.google.com/console
3. Click the project selection menu in the blue navigation bar (1).
4. Next to ‘Select from’ ensure the correct Organization you are creating the service account for is selected (2).
5. Click ‘NEW PROJECT’ (3).

6. Enter a project name.
7. Ensure the correct organization is selected.
8. The location can be left as the default or changed at your discretion.
9. Click CREATE.

10. Click on the “Menu” icon next to "Google Cloud Platform" in the top left of the page.
11. Click 'APIs & Services', then 'Credentials'.

12.  Click CREATE CREDENTIALS, then select 'Service account'.

13.  Enter a service account name.
14. Click ‘CREATE’.

15. In the ‘Select a role’ menu, click ‘Project’, then select ‘Owner’. This step is optional.
16. Click CONTINUE.
17. The Grant users access to this service account section that is displayed next is optional, and can be left blank. Click DONE to continue.
18. Click on OAuth consent screen.

19. Under User Type, select ‘Make Internal’.
20. Select EDIT APP. Enter an application name and enter a Support email and a Developer Contact Email.

21. Click SAVE AND CONTINUE.
22. Select the KEYS tab at the top of the screen, and click the ‘ADD KEY’ dropdown.
23. Click ‘Create new key’.

24. Select ‘P12’, then click ‘CREATE’ - This will download the private P12 key file to be imported into CloudM Migrate.

25. Close the ‘Private key password’ screen (1) as this is not needed.

26. Navigate back to the APIs & Services > Credentials screen.
27. Notice the Oauth 2.0 Client ID has now appeared. Click the copy icon to take a note of the client ID. This will need to be added to Google Workspace later.
28. Take a note of the Service Account Email. This will need to be added to CloudM Migrate later.
29. Navigate to the APIs & Services > Dashboard page.
30. Click ‘ENABLE APIS AND SERVICES’.

31. In the ‘Search for APIs & Services’ search box, enter ‘Admin SDK’.
32. Click on Admin SDK API

33. Click ENABLE.
34. The Admin SDK overview page is now shown. Click ‘APIs & Services’ to navigate back to the main APIs & Services page.
35.  Repeat steps 30-34 to enable each of the required APIs:

• Admin SDK
• Google Drive API
• Gmail API
• Google Calendar API
• People API
• Tasks API
• Groups Migration API
• G Suite Vault API (if you are migrating from Google Vault).
• Cloud Storage (if you are Migrating from Google Storage).

36. If migrating Google Drive, open the Google Workspace Admin console and navigate to Apps > Google Workspace > Drive and Docs > Features and Applications and enable 'Allow users to access Google Drive with the Drive SDK API': Drive SDK needs to  be enabled for all migrating users.

37. Open the Google Workspace admin console and navigate to ‘Security > API Controls > Domain-wide Delegation’ and click on Manage Domain-wide Delegation. Here is a direct link: https://admin.google.com/ac/owl/domainwidedelegation?hl=en
38. Click ‘Add new’ then enter the Client ID, the relevant OAuth scopes listed next, and then click ‘AUTHORIZE’. 

 

If 'Use Limited Scopes' is going to be set as 'False' (default) in the Migration Settings section for the platform in CloudM Migrate, use the full scopes listed here:

• https://www.googleapis.com/auth/admin.directory.resource.calendar,
• https://www.googleapis.com/auth/gmail.settings.sharing,
• https://mail.google.com/,
• https://sites.google.com/feeds/,
• https://www.googleapis.com/auth/admin.directory.group,
• https://www.googleapis.com/auth/admin.directory.user,
• https://www.googleapis.com/auth/apps.groups.migration,
• https://www.googleapis.com/auth/calendar,
• https://www.googleapis.com/auth/drive,
• https://www.googleapis.com/auth/drive.appdata,
• https://www.googleapis.com/auth/email.migration,
• https://www.googleapis.com/auth/tasks,
• https://www.googleapis.com/auth/gmail.settings.basic,
• https://www.googleapis.com/auth/contacts,
• https://www.googleapis.com/auth/contacts.other.readonly,
• https://www.googleapis.com/auth/contacts.readonly,
• https://www.googleapis.com/auth/directory.readonly,
• https://www.googleapis.com/auth/user.addresses.read,
• https://www.googleapis.com/auth/user.birthday.read,
• https://www.googleapis.com/auth/user.emails.read,
• https://www.googleapis.com/auth/user.gender.read,
• https://www.googleapis.com/auth/user.organization.read,
• https://www.googleapis.com/auth/user.phonenumbers.read,
• https://www.googleapis.com/auth/userinfo.email,
• https://www.googleapis.com/auth/userinfo.profile

 

If 'Source Platform Migration Settings > Google Workspace > Email Options > Use Limited Scopes' is set to 'True', use the following scopes:

• https://www.googleapis.com/auth/gmail.labels,
• https://www.googleapis.com/auth/gmail.readonly,
• https://www.googleapis.com/auth/admin.directory.resource.calendar,
• https://www.googleapis.com/auth/gmail.settings.sharing,
• https://sites.google.com/feeds/,
• https://www.googleapis.com/auth/admin.directory.group,
• https://www.googleapis.com/auth/admin.directory.user,
• https://www.googleapis.com/auth/apps.groups.migration,
• https://www.googleapis.com/auth/calendar,
• https://www.googleapis.com/auth/drive,
• https://www.googleapis.com/auth/drive.appdata,
• https://www.googleapis.com/auth/email.migration,
• https://www.googleapis.com/auth/tasks,
• https://www.googleapis.com/auth/gmail.settings.basic,
• https://www.googleapis.com/auth/contacts,
• https://www.googleapis.com/auth/contacts.other.readonly,
• https://www.googleapis.com/auth/contacts.readonly,
• https://www.googleapis.com/auth/directory.readonly,
• https://www.googleapis.com/auth/user.addresses.read,
• https://www.googleapis.com/auth/user.birthday.read,
• https://www.googleapis.com/auth/user.emails.read,
• https://www.googleapis.com/auth/user.gender.read,
• https://www.googleapis.com/auth/user.organization.read,
• https://www.googleapis.com/auth/user.phonenumbers.read,
• https://www.googleapis.com/auth/userinfo.email,
• https://www.googleapis.com/auth/userinfo.profile

 

If 'Destination Platform Migration Settings > Google Workspace > Email Options > Use Limited Scopes' is set to 'True', use the following scopes:

• https://www.googleapis.com/auth/gmail.labels,
• https://www.googleapis.com/auth/gmail.insert,
• https://www.googleapis.com/auth/admin.directory.resource.calendar,
• https://www.googleapis.com/auth/gmail.settings.sharing,
• https://sites.google.com/feeds/,
• https://www.googleapis.com/auth/admin.directory.group,
• https://www.googleapis.com/auth/admin.directory.user,
• https://www.googleapis.com/auth/apps.groups.migration,
• https://www.googleapis.com/auth/calendar,
• https://www.googleapis.com/auth/drive,
• https://www.googleapis.com/auth/drive.appdata,
• https://www.googleapis.com/auth/email.migration,
• https://www.googleapis.com/auth/tasks,
• https://www.googleapis.com/auth/gmail.settings.basic,
• https://www.googleapis.com/auth/contacts,
• https://www.googleapis.com/auth/contacts.other.readonly,
• https://www.googleapis.com/auth/contacts.readonly,
• https://www.googleapis.com/auth/directory.readonly,
• https://www.googleapis.com/auth/user.addresses.read,
• https://www.googleapis.com/auth/user.birthday.read,
• https://www.googleapis.com/auth/user.emails.read,
• https://www.googleapis.com/auth/user.gender.read,
• https://www.googleapis.com/auth/user.organization.read,
• https://www.googleapis.com/auth/user.phonenumbers.read,
• https://www.googleapis.com/auth/userinfo.email,
• https://www.googleapis.com/auth/userinfo.profile

 

Migrating from Google Vault?

If you are migrating from Google Vault, use these API Scopes:

• https://www.googleapis.com/auth/admin.directory.resource.calendar,
• https://www.googleapis.com/auth/gmail.settings.sharing,
• https://mail.google.com/,
• https://sites.google.com/feeds/,
• https://www.googleapis.com/auth/admin.directory.group,
• https://www.googleapis.com/auth/admin.directory.user,
• https://www.googleapis.com/auth/apps.groups.migration,
• https://www.googleapis.com/auth/calendar,
• https://www.googleapis.com/auth/drive,
• https://www.googleapis.com/auth/drive.appdata,
• https://www.googleapis.com/auth/email.migration,
• https://www.googleapis.com/auth/tasks,
• https://www.googleapis.com/auth/gmail.settings.basic,
• https://www.googleapis.com/auth/ediscovery,
• https://www.googleapis.com/auth/ediscovery.readonly,
• https://www.googleapis.com/auth/devstorage.read_write,
• https://www.googleapis.com/auth/contacts,
• https://www.googleapis.com/auth/contacts.other.readonly,
• https://www.googleapis.com/auth/contacts.readonly,
• https://www.googleapis.com/auth/directory.readonly,
• https://www.googleapis.com/auth/user.addresses.read,
• https://www.googleapis.com/auth/user.birthday.read,
• https://www.googleapis.com/auth/user.emails.read,
• https://www.googleapis.com/auth/user.gender.read,
• https://www.googleapis.com/auth/user.organization.read,
• https://www.googleapis.com/auth/user.phonenumbers.read,
• https://www.googleapis.com/auth/userinfo.email,
• https://www.googleapis.com/auth/userinfo.profile

 

Service Account and Scopes Propagation Time

Similarly with the Service account and APIs, adding the Client and Scopes in the Google Workspace console may be subject to a propagation time of up to two hours.

Selecting Check Connections for your Google Workspace platform in CloudM Migrate may not be successful immediately.

 

Destination prerequisites for Microsoft 365

The following prerequisites are for migrations that use Modern Authentication as the Authentication Method. Modern Authentication is the recommended method as Basic Authentication is being deprecated.

• Ensure that you have an Admin User in your Azure AD account. The Global Admin Role is recommended, but not mandatory.
• Ensure that a Test User has a license with a mailbox.

 

Start a new configuration project

1. Login to CloudM Migrate,
2. Select Projects in the Functions column on the left side of the screen,
3. Select the Add button (+ icon) to prompt the section to expand,

4. Select the Create a new project option,
5. In the pop-up box, select Google as the Destination platform (the platform that you want to migrate all of your users and data to) and enter the Domain Name (the destination domain you are migrating to), a Configuration Name of your choice and License Key.

6. Select Check License to ensure that the license entered is valid for the destination platform that you want to migrate to.
7. Select Continue.
8. The project will now be displayed in the domain drop down menu at the top of the screen. Make sure that the project is selected.

 

Create a new configuration

To create a new configuration:

1. Select the Create a new configuration to get started option.
2. In the pop-up box, select Google as the Destination platform (the platform that you want to migrate all of your users and data to) and enter a Configuration Name.

3. Select Continue. 
4. The configuration will now be displayed in the Configuration Overview.

 

Once the configuration is created, it will be displayed in the Configuration Overview table. Select Configure, enter a CloudM license key and select Apply to start the configuration process. 

 

Configure Source Platform Settings

Choose Lotus Notes as the migration source and enter your HCL Notes (Lotus Notes / IBM Domino) settings into CloudM Migrate and then click Next.

 

Multi-Server configuration and network access - In a multi-server configuration, it is vitally important that the Master and Secondary servers have full network access. In some scenarios, this may require configuring proxy settings through Internet Explorer by clicking Tools > Internet Options > Connections > Local Area Network (LAN) settings to allow access.

 

Server Details

• Server Address – The hostname or IP address of the Lotus Notes server.
• ID File – The path to the Administrator's Notes ID File.

 

Client Authorization Settings

• Admin Username – The abbreviated name of the administrative user that will be used to perform migrations. This should be of the form ‘Administrator/ORG’
• Admin Password – The administrator’s password. This should be the password that can be used to access Notes using the ID file of the administrative user, who should have previously logged into Notes from the migration workstation.

 

 

Windows Authorization Settings

• Windows Username – The username of the Windows User the Notes migration should run as (normally the same as the currently logged in user).  Specify domain\username if required.
• Windows Password – The password for the Windows user.

 

Resource Database Details

These settings can usually be left at the default settings unless special customization is required based on your Notes infrastructure.

• Resource Database – The name of the server database containing resources. If there are no resources, please leave this setting empty.
• Resource Views – The views within the resource database containing resources.

 

User Database Details

These settings can usually be left at the default settings unless special customization is required based on your Notes infrastructure.

• User Database – The name of the server database containing users.
• User View – The view within the user database containing users.
• Import Name Attribute – The name of the attribute used to generate the ‘Import Name’ field in the user list. Only the name part of any email address is used.

 

Configure Destination Platform Settings - Google Workspace

Select Google Workspace as your destination platform.

Select where you would like your data to be migrated. If you have purchased Google Vault, you may want to migrate data directly into Google Vault.

To enable Google Vault for your domain, please see this article

 

Select Add Settings.

Enter information for your Google Workspace admin account.

• Domain Name - The domain name you will be migrating from. This should be the Internet domain name, not the local domain name.
• Admin Username - An administrator account for the domain specified, this will usually be an email address for a Super Admin.
• Service Account Email Address - Before attempting to configure CloudM Migrate, you should have created a Google Cloud platform project and created a service account for it. Input the service account's email address in this field.
• Private Key - The file path to the P12 key that was generated and downloaded when creating the OAuth service account.

If you cannot find the private key, go back to Google Cloud Platform service accounts, select your project (if not already selected), use the option button on the right of the service account and click Create Key. Select P12 and download the key file.

• All Advanced Settings are set to a default value, designed to ensure that your migration will work without additional configuration. You should only edit the Advanced Settings if instructed to by CloudM Support or in a CloudM Knowledge Base article.

 

CloudM Migrate will perform a connection test against your Google Workspace domain to verify that everything has been entered correctly.

If your Google Workspace system is brand new or, for any reason, the users being migrated have not been created in Google Workspace, CloudM Migrate can create your users for you. Simply go to Advanced settings > User section and enable Create Users/Resources/Groups/Shared Drives.

 

Configure Destination Platform Settings - Microsoft 365

Basic Platform Settings

Choose Microsoft Office 365 as the migration source and enter your Microsoft Office 365 settings into CloudM Migrate and then click Next.

• All Advanced Settings are set to a default value, designed to ensure that your migration will work without additional configuration. You should only edit the Advanced Settings if instructed to by CloudM Support or in a CloudM Knowledge Base article.

 

Set the following settings:

• Office / Microsoft 365 Plan - Set to Office 365
• Authentication Method - Choose the authentication type that will be used with the server. For Microsoft 365, set to Modern.
• Domain Name - The domain name of the Exchange domain. This should be the internet domain of the Exchange system and not the local domain name.
• This might be the part after the @ in your administrator email address. 
• If migrating from several different domains, several migrations will be needed.
• Admin Username - The email address of a global administrator within your Microsoft 365 environment.
• Admin Password - The password for the global administrator account specified earlier.
• Test Username - The email non-admin user who is already present in the system to test connections.
• Specify a primary SMTP email address (or just the part before the @ symbol and the domain name will be appended). The test user must have an active mailbox.

 

If you have Modern Factor Authentication (MFA) enabled:

Authenticate using the Powershell Script (as detailed in the Modern Authentication for Microsoft 365 article). You will not be able to use the web application to authenticate due to logging in issues caused by MFA. 

Once the Powershell process has been completed, click Next to trigger a connection test.

 

If you do not have Modern Factor Authentication (MFA) enabled:

1. Click the Create Azure AD Application button, and click the button again in the popup.

2. The Client ID, Certificate Path and Certificate Password fields should now be set. Click the Next button to test the connection.

 

Migrate files to Microsoft 365

If you want to migrate files to Microsoft 365, you will also need the Sharepoint Admin URL. The URL will look similar to the URL below:

• https://tenant-admin.sharepoint.com. 

To input the URL, click Advanced Settings and locate Sharepoint Admin URL under the OneDrive for Business/SharePoint settings.

Connection test

Once you have configured the Platform settings, click on Next. CloudM Migrate will now perform a small connection test to verify that the details you have entered are correct.

If this fails, you may have entered something incorrectly. If you still cannot resolve the issue, please contact CloudM Support.

 

Select which items to migrate

It's now time to add which items you'd like to migrate.

To add the items from that you want to migrate from your source platform to your destination platform, select Add items to migrate drop down menu and click on one of the following options:

• Get Items from source - Get a full list of all items in the source platform.
• Bulk add / import items - Upload a CSV file to bulk add users.
• Add User / Resource - Manually add an item of the selected item type.

Selecting a Star next to any specific user or users will prioritize their migration. When a migration starts, threads will be assigned to any starred user so that their migration can start immediately. 

Enter your user's full email address within the Export Name field.

 

Select how much content to migrate

CloudM Migrate lets you decide how much content to migrate to your domain by specifying required date ranges. 

If you are changing your email address as part of the migration you can verify that the domain names are correct here. You can also specify specific Address Replacements in the respective section of the advanced settings.

Target Audience permissions can also be migrated but they must be replaced using Address Replacements in order to migrate successfully. If they are present on the source but not migrated to the destination platform, any items shared with it will be shared back to the source Target Audience.

 

Environment Scan

Environment Scan allows you to plan and prepare your migration by performing analysis of your source file and mail environment and reporting important information such as item counts, data volume, permissions, and folder depth.

Reports are produced which can be exported and analysed. Using the information provided you can estimate your migration's duration more accurately, and address any potential issues before your migration even begins.

 

Selecting Scope of Scan

Items

Depending on your source platform, you can choose to scan files, emails, or both sets of items.

• Leaving the Report on File Permissions setting unchecked will speed up the Environment Scan process.
• In order to include Report on File Permissions in the process, you will need to check this setting AND enable Document Sharing (or a setting related to document sharing) in the Source Platform settings. If either is not enabled, the Environment Scan will not scan or report on File Permissions.

 

Users

Your CloudM Migrate userlist is used to define the scope of the scan. You can choose to scan all accounts from your list, or restrict the scan to users selected for migration.

 

How to run an Environment Scan

After entering your source and destination server settings, populating your userlist, and configuring your settings, you will be prompted to run an environment scan. It is optional, but recommended, for all file platforms.

Click Start and then confirm by selecting Start Environment Scan on the pop-up box to begin the scan. CloudM Migrate will connect to your source environment and capture file and / or mail information. This can take up to several hours, depending on the amount of data present.

 

Once the scan completes, the data is reported on the Environment Scans page and can be exported to file, using the Export Scan Results option.

 

Start your migration

We know that you may want to start your migration in the middle of the night, or over the weekend, but we don't expect you to stay up in order to do so. With CloudM Migrate, you can decide to schedule exactly when you'd like the migration to occur.

If you want to start the migration straight away, select Start.

 

Migration Readiness Test

The Migration Readiness Test provides a last check before starting a migration (regardless of the source or destination platform - with the exception of PST Archives, Google Cloud Storage and Microsoft Azure Storage). The Drive Readiness Test is now included as part of the Migration Readiness Test. 

The test will be optional but is highly recommended, especially in cases where the user has made numerous changes to their configuration. You can only run one Migration Readiness Test at a time.

 

The test includes:

• Checking where changes have been made to general and advanced migration settings (differing from the default values) and suggest any potential issues that these settings could cause,
• Scanning the Source and Destination platform to ensure that the connections work properly,
• Flagging up any additional limitations, allowing users to resolve any issues before their migration begins.

 

To run the Migration Readiness Test:

1. After conducting an Environment Scan, select Next,
2. On the Summary screen, select Start (or click on the Migration Readiness Tests field),

3. A Migration Readiness Test pop-up screen will be displayed, as shown below,

4. You can choose to skip the Migration Readiness Test (by placing a tick in the checkbox), but we highly recommend running the test,
5. Select Start Readiness Test,
6. The results will start to propagate as settings are checked,
• If the setting is properly configured, the check results will be highlighted in Green,
• If the setting is different to the default value, it will be highlighted in Blue with a description of the setting. These results reflect changes that you have made, but should still be checked here to make sure that they are still correct for your migration,
• If the setting has failed (usually when attempting to connect to a source or destination platform), the check result will be highlighted in Red. These settings need to be rectified or your migration will fail.

7. Select Close to close the pop-up screen.
8. Once all errors are corrected, you can start your migration.

 

To export the report (for example, if prompted by our Support Team):

1. Once the test has been completed, select the Export option,
2. The report will be exported in CSV format and will save in your computer's Downloads folder.
3. Attach the CSV file to your Support ticket.

 

Review your migration results

During the migration process, CloudM Migrate will report back in real time exactly who is being migrated and the items being processed. All you now need to do is sit back, relax and wait for your migration to complete.

Check the progress of your migration.

Once complete you can download a full report for your migration.