- Mapping the Design Components
- Evaluating Different Design Options
- Active Directory Design Details
- Defining Storage Groups and Multiple Databases
- Defining Administrative and Routing Groups
- Designing Remote Access to Exchange 2000
- Exchange 2000 Support and Maintenance Tasks
- Case Study for SmallCompany Inc.
- Case Study for MediumCompany Inc.
- Case Study for LargeCompany Inc.
- Summary
This chapter is from the book
This chapter is from the book
This chapter is from the book
Active Directory Design Details
Because the Active Directory plays a very important role in the way that Exchange 2000 operates, Active Directory Domain Controller server roles and Active Directory groups need to be planned and designed properly. Active Directory Domain Controllers determine the availability, and ultimately the access response time, for users to view Exchange messaging recipients as well as distribution lists. If a Domain Controller is far from the users, the response time it will take for a user to see the other members or distribution lists in the Exchange environment can be significantly delayed. However, creating and placing too many servers throughout the environment can cause an overload for replication that can saturate a WAN connection. So a balance needs to be made between access time by users and WAN saturation between Domain Controllers.
Also crucial to the Active Directory design is how groups are used in an organization. Groups in Active Directory become effectively distribution lists for e-mail users to send a message to multiple users.
Both of these Active Directory design criteria can have significant impact on the user experience as well as WAN bandwidth demands.
Planning Exchange 2000 Server Roles
There are two Windows 2000/Active Directory roles that an Exchange server can perform. The server can either be a Domain Controller or a member server of the Active Directory Domain. These roles are distinct in that the Domain Controller is responsible for providing local access to the directory and to facilitate in the user authentication process. The member server acts as a resource server and typically hosts a network-based application such as Exchange 2000.
It is not uncommon for organizations to deploy the Exchange server and the Domain Controller to smaller branch offices (30 or fewer users per branch office) on the same box. The rationale behind this design choice is cost. In most cases, organizations cannot justify the additional hardware expense associated with the purchase of servers that will be dedicated to only one function.
There are considerations that need to be accounted for when using this type of strategy. Combining these two roles will have greater resource requirements. Even though there are cost savings associated with this configuration, it is not recommended. The savings do not justify the risk related with combining both roles on one server.
Another area that needs to be considered relates to disaster recovery. If the dual role configuration were to be used, the backup program would also need to back up the Active Directory components of the Windows 2000 system state. This includes the Active Directory Schema (NTDS) and the system volume (SYSVOL). A successful restore of the server may also be put at risk. These additional steps add another layer of complexity required when restoring a failed DC/Exchange 2000 server.
Implementing Groups in the Active Directory and Its Impact on Exchange 2000
The Global Catalog (GC) contains the directory information of the entire forest. Exchange 2000 uses Active Directory Groups (includes Domain Local, Global, and Universal groups) as e-mail Distribution Lists (DLs). The domain model that is implemented directly impacts the replication of group information throughout the forest. Each of the three groups behaves differently with regard to the way they replicate group information:
A Domain Local group does not replicate outside of its established domain. Only users that are contained within that domain will be able to use the Domain Local group list(s) for that domain.
A Global group replicates the group name but not the membership information to other domains.
A Universal group replicates all of the group information to the entire forest, assuming that the Windows 2000/Active Directory installation is operating under native mode.
Even though this chapter may recommend that at the minimum one Global Catalog server be contained per site, this recommendation is not consistent with specifications provided by Microsoft. Microsoft recommends the following:
Two or more Global Catalogs per Active Directory site
One Global Catalog per Exchange 2000 server domain
One Global Catalog for each domain containing Exchange clients
Because the Active Directory Global Catalog is the sole source of user and distribution list information for Exchange 2000, all queries for messaging users need to access the Global Catalog. Experience in the field has found that organizations should place Global Catalogs close to the users because user performance and access to the Global Catalog is dependent on how quickly the user can access it. If the Global Catalog is on the other side of a slow WAN connection, the user experience would be hindered by slow response time for catalog lookup.
For example, in a small company with a single location, multiple GCs will provide redundancy, which in turn will support the service level agreement regarding availability. In a multisite implementation with small remote locations (50 users or fewer), placing a Global Catalog in the remote location will benefit user look-up to the address book for the organization.