Configuring a Microsoft Exchange Server 2003 Infrastructure : Post-Installation Considerations

Exchange Server 2003 Services

Several new services are installed as part of the Exchange Server 2003 installation process. Figure 1 shows these services and their default configuration for Startup Type, the account the services Log On As, and the current state of the service (started or stopped).

Table 1 lists and describes the services that are installed in a typical installation.

Service Dependencies

Troubleshooting problems with Exchange Server 2003 often involves services that have stopped. A problem you are trying to solve might seem as though it is the result of one service failing, when the service in question stopped only because a service it was dependent upon stopped first. For example, if users could not log on to their Exchange Server 2003 server, you check the services and notice that the Information Store service has stopped. While the problem could be related to the Information Store service itself, you might also find that the Information Store service stopped only because the System Attendant service stopped. The System Attendant may have stopped because a service it depends upon stopped, and so on. Table 2 lists the dependencies for the Exchange Server 2003 services.

Service Logon Accounts

In Figure 3-1, in the Log On As column, notice that by default Exchange Server 2003 uses the Local System account to start each of the services. The Local System account is a built-in account that has full administrative rights; most services are associated with this account by default. Applications such as Exchange Server 2003 use it automatically because it is a known account with the correct permissions. However, when you have multiple services sharing the same logon account, troubleshooting security can be more difficult. Therefore, it is recommended that you use a dedicated service account for your Exchange Server 2003 services. You will configure the services to use your dedicated service account later in this lesson.

Delegation of Authority

Another post-installation consideration with Exchange Server 2003 is identifying the user accounts to which you will delegate administrative authority for the Exchange organization. When you installed Exchange Server 2003, the user account used was automatically given Exchange Full Administrator rights, which includes the ability to administer all configuration details of the Exchange organization and the ability to modify permissions. No other accounts are given rights to administer the Exchange organization. This means that any future administration has to be performed under the security context of the account that installed Exchange Server 2003. This is impractical and largely undesirable for a few reasons. First, if you have multiple Exchange administrators, you want to be able to track the activity of each administrator through the Security log. If all administrators use the same user account, it will be much more difficult to accomplish this. Another reason is that it will be necessary to distribute the service account password to every administrator, which will compromise security. In addition, each administrator will have the same level of permissions to the Exchange organization, which isn’t desirable either.

The best practice is to delegate authority to the groups or individual users that need to administer the Exchange organization. The standard practice in system administration is to use security groups wherever possible for assigning permissions and to assign permissions to individual users only when absolutely necessary. By following these practices, an administrator is better able to manage and maintain security in an enterprise environment.

Exchange Server 2003 supports three administrative roles that can be delegated using Exchange System Manager: Exchange Full Administrator, which can manage anything in the organization including permissions; Exchange Administrator, which can manage everything in the organization except permissions; and Exchange View Only Administrator, which has read-only administrative access to the Exchange organization.

Administration from Client Workstations

Exchange administration tasks, including delegating authority, should not be performed directly from the server consoles. Secure environments strictly limit the ability to log on locally to a server, perhaps to only the Administrator account. Allowing regular user accounts to log on locally to servers, especially domain controllers, is not a recommended security practice.

If you have a workstation that meets the criteria, you can install Microsoft Exchange System Management Tools and administer the Exchange organization from there. Table 3 lists the system requirements necessary to install Microsoft Exchange System Management Tools. The requirements for non-Exchange servers are given, as well, in case you need to install the tools on a server that isn’t running Exchange Server 2003. If a service pack level is given, the service pack is part of the requirements, and the tools cannot be installed on a system that isn’t at that service pack level or later. A basic requirement for any management workstation is that it is a member of the same domain and forest as the Exchange organization.

The Microsoft Exchange System Management Tools installation is very similar to the Exchange Server 2003 installation. When your management workstation meets all the requirements, run Setup from the Exchange Server 2003 installation CD. The Microsoft Exchange Installation Wizard will start, and you will go to the Component Selection page and perform a Custom installation. The only component you need to select is Microsoft Exchange System Management Tools; however, if you will be managing any Exchange Server 5.5 servers, as well, you can also install the Microsoft Exchange 5.5 Administrator. Once Setup completes, you will be able to start Active Directory Users And Computers and Exchange System Manager and complete tasks using the rights that you have been delegated.

Adding and Removing Exchange Server 2003 Components

There might be times when you need to add or remove an Exchange Server 2003 component. Perhaps you installed the Microsoft Exchange Connector for Novell GroupWise as part of the process of migrating GroupWise to Exchange Server 2003, and with that process now complete, you want to remove the connector component. Or perhaps your company has recently acquired a company that has an Exchange 5.5 organization, and you need to install the Microsoft Exchange 5.5 Administrator in order to administer that site. Whatever the circumstance, the process of adding or removing an Exchange Server 2003 component involves re-running Exchange Server 2003 Setup and changing the selections on the Component Selection page of the Microsoft Exchange Installation Wizard.

Usually adding or removing a component is as simple as running the Microsoft Exchange Installation Wizard. However, if the installation wizard won’t allow you to add or remove a component and you know there shouldn’t be a problem with it, there are ways to accomplish the task manually.