Exchange Server Cookbook

Chapter 3. Active Directory Integration

Introduction

Exchange 2000 and Exchange Server 2003 are completely dependent on a functioning Active Directory infrastructure. Exchange 5.5 used its own independent directory that contained mailbox objects that were separate from their corresponding Windows NT domain accounts. Exchange permissions were completely separate from Windows NT permissions, and Exchange had its own authentication and authorization mechanisms for controlling access to Exchange data. In Exchange 2000 and Exchange Server 2003, all authorization and authentication is built on Active Directory. Almost every aspect of Exchange’s normal operation depends on Active Directory in some way:

• When a user attempts to log on to a mailbox (whether through MAPI, HTTP, IMAP, or POP), her credentials are passed to an Active Directory domain controller for validation.

• Each server’s routing engine retrieves an initial copy of the routing link state table from the forest configuration container, making initial convergence of the routing table much faster.

• When mail arrives at a server, the categorizer component of the Exchange transport core looks up the recipient addresses in Active Directory to decide if the recipient has a mailbox on that server or if it must be routed to another server in the organization.

• A wide variety of properties and controls for various operations (including automatic conversion of distribution groups to security groups, the location of the SMTP queue directories, ...