Earlier I posted about the new GAL Photos feature in Exchange 2010 and Outlook 2010. Since then, there have been many implementation-related questions internally and from customers.

Here are some FAQs

Q. Do I need Exchange 2010 to display GAL Photos?
A. As noted in the post, Active Directory has the thumbnailPhoto attribute. Outlook 2010 has the client-side feature to display the photo. Exchange 2010 provides the Import-RecipientDataProperty cmdlet to easily import the picture (yes, a GUI would've been nice - we hear ya!), and Exchange 2010's Offline Address Book (OAB) has the ability to include the necessary pointers to AD to allow Cached Mode clients to display the picture - the client still needs to be able to communicate to AD to download the picture. You can make it work for Outlook 2010 clients without using Exchange 2010, but Cached Mode support is an Exchange 2010 + Outlook 2010 feature.

If you can write the code/script to upload the picture blob to AD (or find the script/code on the web), you can make it work with a previous version of Exchange. We recommend you treat all scripts/code downloaded from the web as untrusted code and test it thoroughly in a non-production environment.

Q. What are Active Directory requirements? Do I need Windows 2008 R2?
A. Windows 2008 R2 is not required. In fact, the thumbnailPhoto attribute has been around since Windows 2000.
- However, the mAPIID attribute should have the value 35998. This happens when domain controllers are running Windows 2008 or later, or if your Active Directory schema has been updated to Windows 2008. If not, you can run forestprep from Windows 2008 to update it. For details, check out Prepare a Windows 2000 or Windows Server 2003 Forest Schema for a Domain Controller That Runs Windows Server 2008 or Windows Server 2008 R2. In an environment with mutliple forests, you must update each forest that has users or Exchange servers.
- You must set the thumbnailPhoto attribute to replicate to the Global Catalog, as shown in the original post, although it'll work without this modification in single domain environments.

Q. Is the thumbnail saved in my OAB?
A. No, by default it isn't. As noted in the previous post, the Exchange 2010 OAB simply includes a pointer that the data exists in AD. You can modify it to include the photo blob in the OAB. We recommend testing it in a non-production environment to determine, depending on the number of users in your organization, whether you can support the resulting OAB size.

Q. How can I add the thumbnail to my OAB?
A. Remove the thumbnailPhoto attribute as an Indicator attribute from the OAB using the following code (also provided in the original post):

$attributes = (Get-OfflineAddressBook "Default Offline Address Book").ConfiguredAttributes
$attributes.Remove("thumbnailphoto,Indicator")
Set-OfflineAddressBook "Default Offline Address Book" -ConfiguredAttributes $attributes

Add the attribute as a Value attribute:

$attributes.Add("thumbnailphoto,Value")
Set-OfflineAddressBook "Default Offline Address Book" -ConfiguredAttributes $attributes

Remember to update the OAB once you're done uploading photos.

Update-OfflineAddressBook "Default Offline Address Book"

Q. Does Outlook 2010 cache the photos?
A. Outlook 2010 caches the photos for the session so it doesn't pull the data from Active Directory again during that session. If Outlook 2010 doesn't have Active Directory connectivity, and the thumbnailPhoto attribute isn't included as a Value attribute in the Offline Address Book, it won't display the thumbnail.

Q. Can Outlook 2007 display GAL photos?
A. No, Outlook 2007 displays photos for Contacts if the user has saved them. This is a client-side feature and no data is uploaded to AD. For details, see Add, change, or remove a picture for a contact.

Q. When users send an email to external recipients, are photos sent outside my organization?
A. No, the thumbnail photos are not sent with email. As indicated above, Outlook 2010 clients in your organization fetch the data from Active Directory (or the Offline Address Book, if you've modified the ConfiguredAttributes parameter for the OAB to include it as a value attribute). If your Active Directory is accessible to anonymous users from outside the organization, meet me at camera 2! :)

-- Bharat Suneja