As mentioned, the BES acts as a data traffic controller, so we need to make sure that it and the relevant components can authenticate into the Windows domain and messaging service available on your corporate network.
We do this by creating a service account for administrative tasks that the BlackBerry Enterprise Server needs to carry out and communicate with the Microsoft Exchange Server. The account has an Exchange mailbox associated with it. Generally, the accepted username for the service account is BESAdmin.
The BESAdmin account will need to have view permissions to the Exchange Server, so it can read data from the messaging server. The Microsoft Exchange Server holds e-mail information in the Information Store. The BESAdmin account needs to access this information so it will require relevant view and allow permissions on the Exchange server as shown in Lab 1.
To enable end users to send e-mails from their devices, we need to make sure that the BESAdmin account can authenticate to the Exchange Server and has Send As permissions for all the end users that will be sending e-mails from their device.
The preceding two steps must be carried out prior to installing the BES, as it creates an account we can use to authenticate our BES to the messaging server, and allows end device users to be able to send e-mails from their BlackBerries via the BESAdmin account.
We need to ensure that we have local administrator privileges on the server that we are going to install the BES software on, so that we can log in to the server and run the BES services as a Windows Service — remember that the software will be installed using the account we have created — BESAdmin. We need to make sure that the BESAdmin account is not a member of the Domains Admin Group in the Microsoft Active Directory. Some groups are periodically reset by the system, even if they have been manually configured by the administrator, so it is best practice not to have the account in a group where it does not need the elevate permissions associated with the Domains Admin group — this also ensures a safer secure network.
Note
Note that the BESAdmin account in BES version 5.0 is purely a service account used for administrative tasks by the BES. We can create and use any account to log in to the BlackBerry Administration Service as shown in Lab 1.
The BlackBerry Enterprise Server system requirements vary based on the number of users supported and the additional services running on the BES. For detailed minimum requirements for BES please see: http://us.blackberry.com/support/preinstallation/exchange.jsp.