Harold Wong Senior Technology Specialist Microsoft Corporation 24 Hours of Exchange Server 2007 (Part 01 of 24): Integration of Exchange Server 2007 and Active Directory

What Will We cover? Microsoft ® Exchange Server 2007 integration with Active Directory ® directory service Message routing using Active Directory sites New Exchange Server administrator roles

Microsoft ® Exchange Server 2007 integration with Active Directory ® directory service

Message routing using Active Directory sites

New Exchange Server administrator roles

Helpful Experience Experience with Active Directory Understanding of Active Directory sites Experience with Microsoft® Exchange Server 2003 Level 200

Experience with Active Directory

Understanding of Active Directory sites

Experience with Microsoft® Exchange Server 2003

Agenda Integrating with Active Directory Planning for Exchange Server 2007 Understanding Exchange Server permissions

Integrating with Active Directory

Planning for Exchange Server 2007

Understanding Exchange Server permissions

Architectural Goals

Active Directory Topologies Resource Forest Cross Forest Single Forest

Review: Integrating with Active Directory (1) Which of the following was not one of the basic architectural goals in the development of Exchange Server 2007? Complexity Flexibility Trustworthiness Scalability

Which of the following was not one of the

basic architectural goals in the development

of Exchange Server 2007?

Complexity

Flexibility

Trustworthiness

Scalability

Review: Integrating with Active Directory (2) Which type of Active Directory topology allows you to separate the administration of Exchange Server from that of Active Directory? Single forest topology Cross-forest topology Resource forest topology Multiple forest topology

Which type of Active Directory topology

allows you to separate the administration of

Exchange Server from that of Active Directory?

Single forest topology

Cross-forest topology

Resource forest topology

Multiple forest topology

Review: Integrating with Active Directory (3) In a cross-forest infrastructure, what Exchange Server 2007 role manages the communication between organizations? Client Access server role Edge Transport server role Hub Transport server role Mailbox server role

In a cross-forest infrastructure, what

Exchange Server 2007 role manages the

communication between organizations?

Client Access server role

Edge Transport server role

Hub Transport server role

Mailbox server role

Agenda Integrating with Active Directory Planning for Exchange Server 2007 Understanding Exchange Server permissions

Integrating with Active Directory

Planning for Exchange Server 2007

Understanding Exchange Server permissions

Active Directory Site Structure for Routing Mail

Overview of IP Site Links 10 10 15 10 15 10 10 10 IP Site Link

Access to Active Directory User Configuration Site Configuration Exchange Server 2007 Roles Schema Partition Configuration Partition Domain Partition

Server Roles and Active Directory Active Directory API Edge Transport Server Role Schema Partition Configuration Partition Domain Partition Mailbox Server Role Unified Messaging Server Role Client Access Server Role Hub Transport Server Role

Exploring the Demo Environment Explore Domain Users and Computers Check the Active Directory Partitions demonstration

Exploring the Demo Environment

Explore Domain Users and Computers

Check the Active Directory Partitions

Review: Planning for Exchange Server 2007 (1) Where does Exchange Server 2007 store attribute, configuration, and recipient information? Schema partition Configuration partition Domain partition All of the above

Where does Exchange Server 2007 store

attribute, configuration, and recipient

information?

Schema partition

Configuration partition

Domain partition

All of the above

Review: Planning for Exchange Server 2007 (2) How does Exchange Server 2007 determine the best route to deliver mail within an Exchange organization? By the cost of an IP site link By the fastest WAN connection Using routes configured in Exchange Server By the replication interval of a site link

How does Exchange Server 2007 determine the best route to deliver mail within an Exchange organization?

By the cost of an IP site link

By the fastest WAN connection

Using routes configured in Exchange Server

By the replication interval of a site link

Review: Planning for Exchange Server 2007 (3) Which server role will first attempt direct communication rather than examining site link costs when sending data between sites? Client Access server role Edge Transport server role Hub Transport server role Mailbox server role

Which server role will first attempt direct

communication rather than examining site

link costs when sending data between sites?

Client Access server role

Edge Transport server role

Hub Transport server role

Mailbox server role

Agenda Integrating with Active Directory Planning for Exchange Server 2007 Understanding Exchange Server permissions

Integrating with Active Directory

Planning for Exchange Server 2007

Understanding Exchange Server permissions

Administrative Changes Exchange Server 2003/2000 Administrative Groups Insufficient flexibility to effectively manage permissions Rarely used in Exchange Server 2003 organizations

Exchange Server 2003/2000 Administrative Groups

Insufficient flexibility to effectively manage permissions

Rarely used in Exchange Server 2003 organizations

Exchange Server Security and Permissions Exchange Server 2003 Predefined Security Roles Lack of specificity Little difference between roles No clear separation between Exchange Administrative Roles and Active Directory Admins Exchange Server 2007 New Administrator Roles Managed from either the Exchange Management Console or the Exchange Management Shell No need to alter ACL settings

Exchange Server 2003

Predefined Security Roles

Lack of specificity

Little difference between roles

No clear separation between Exchange Administrative Roles and Active Directory Admins

Exchange Server 2007

New Administrator Roles

Managed from either the Exchange Management Console or the Exchange Management Shell

No need to alter ACL settings

Split Permissions Model

Administrator Roles in Exchange Server Exchange Organization Administrators Exchange Recipient Administrators Exchange Server Administrators Exchange View-Only Administrators Owners of the Exchange organization Read access to all domain user containers Write access to all Exchange-specific attributes Owner of all local server configuration data Must run Setup /PrepareDomain for each domain for this group to be applicable Read access to all the Domain User containers Write access to all the Exchange-specific attributes Owner of all local server configuration data. Local administrator on the computer on which Exchange Server is installed. Members of Exchange View-Only Administrators Read-only access to the entire Exchange organization tree Global Data Recipient Data Server Data

Owners of the Exchange organization

Read access to all domain user containers

Write access to all Exchange-specific attributes

Owner of all local server configuration data

Must run Setup /PrepareDomain for each domain for this group to be applicable

Read access to all the Domain User containers

Write access to all the Exchange-specific attributes

Owner of all local server configuration data.

Local administrator on the computer on which

Exchange Server is installed.

Members of Exchange View-Only Administrators

Read-only access to the entire Exchange organization tree

Accessing Administrative Roles Explore the Administrative Roles demonstration

Accessing Administrative Roles

Explore the Administrative Roles

Review: Understanding Exchange Permissions (1) How many predefined administrative groups are provided with Exchange Server 2007? Three Four Five Six

How many predefined administrative groups

are provided with Exchange Server 2007?

Three

Four

Five

Six

Review: Understanding Exchange Permissions (2) Which role provides permissions to modify any Exchange property on an Active Directory user, contact, group, or public folder object? Exchange Organization Administrators Exchange Recipient Administrators Exchange Server Administrators Exchange View-Only Administrators

Which role provides permissions to modify any

Exchange property on an Active Directory user, contact, group, or public folder object?

Exchange Organization Administrators

Exchange Recipient Administrators

Exchange Server Administrators

Exchange View-Only Administrators

Review: Understanding Exchange Permissions (3) Which role does not provide organization-wide permissions to an Exchange administrator? Exchange organization administrators Exchange recipient administrators Exchange server administrators Exchange view-only administrators

Which role does not provide organization-wide

permissions to an Exchange administrator?

Exchange organization administrators

Exchange recipient administrators

Exchange server administrators

Exchange view-only administrators

Session Summary Exchange Server 2007 utilizes Active Directory sites and site links for routing mail Each server role manages Exchange data in Active Directory partitions Improved Exchange administrative roles simplify permission delegation

Exchange Server 2007 utilizes Active Directory sites and site links for routing mail

Each server role manages Exchange data in Active Directory partitions

Improved Exchange administrative roles simplify permission delegation

Questions and Answers Submit text questions using the “Ask” button. Don’t forget to fill out the survey. For upcoming and previously live webcasts: www.microsoft.com/webcasts Got webcast content ideas? Contact us at: http://go.microsoft.com/fwlink/?LinkId=41781 Today's webcast was presented using Microsoft ® Office Live Meeting. Get a free 14-day trial by visiting: www.microsoft.com/presentlive

Submit text questions using the “Ask” button.

Don’t forget to fill out the survey.

For upcoming and previously live webcasts: www.microsoft.com/webcasts

Got webcast content ideas? Contact us at: http://go.microsoft.com/fwlink/?LinkId=41781

Today's webcast was presented using Microsoft ® Office Live Meeting. Get a free 14-day trial by visiting: www.microsoft.com/presentlive