This Exchange 2003 Guidelines document is a work in progress, and is current as of May 5, 2004.

Transcription

1 This Exchange 2003 Guidelines document is a work in progress, and is current as of May 5, 2004.

2 docad.cgiar.org Home Exch 2003 Site Map Exchange 2003 Guidelines System-wide Policies - open for review The following sections are available for feedback. The system-wide policies are being integrated into this documentation during the review process, with final edits expected by 18 May. 1. Specification of Architecture 2. Implementation Policies and Guidelines 3. Case Histories from the CGIAR Centers Exchange 2003 Site Map Active Directory Guidelines Specification of Architecture Policies Overview Best Practices Recommendations for Centers Case Histories from the CGIAR Centers Active Directory Site Map Welcome The purpose of this web site is to assemble the information necessary to implement and maintain Active Directory and Exchange 2003 in the CGIAR. A button has been provided on each page for supplying feedback. The button starts a mail message to the CGNET team, with the subject line filled in as the topic of page. Please send your comments as you read through the site; every effort will be made to rapidly incorporate all feedback into the site itself. CGNET Team Exchange Authors: Karin Cornils, Eric Romero, Peter Ditoto Support: Dan Sweet, Ned Balzer, Gena Zolotar, Ken Novak, Dale Yamamoto Document revision history 5/5/04 Initial release - CGIAR Exchange 2003 Guidelines 4/21/04 Initial release - Exchange 2003 System-wide Policies 3/18/03 Initial release - Active Directory Guidelines

3 Copyright 2004 docad.cgiar.org

4 docad.cgiar.org Home Exch 2003 Site Map Exchange 2003 Site Map CGIAR Exchange 2003 Guidelines - available for feedback Specification of Architecture Rationale Diagrams CGIAR Exchange 5.5 Exchange 2003 Mail Flow Coexistence CGIAR Exchange 5.5 Exchange 2003 Migration Stages Flowchart of System-Wide Exchange 2003 Migration Process Implementation Policies and Guidelines Exchange Naming Conventions Licensing Policies Windows Server 2003 Licensing Exchange Server 2003 Licensing Windows Server 2003 Activation Acceptable Software Versions Architecture Policies Server Placement and Configuration Exchange Server Hardware Routing Policy Options Security Configurations Migration Policies System-wide Migration Policies Center Migration Policies Windows 2003 Preparation and Upgrade Procedure Guidelines Windows 2003 Preparation Guidelines Active Directory Windows 2003 Upgrade Procedure Guidelines Exchange 2003 Preparation and Upgrade Procedure Guidelines

5 3. 1. Exchange 2003 Preparation Guidelines 2. Exchange 2003 Upgrade Procedure Guidelines 8. Exchange 2003 System Monitoring Recommendations Case Histories from the CGIAR Centers System-wide Policies - open for review Architecture Overview Policies Based Upon Constraints Prerequisites to the first center Exchange 2003 Upgrade Preparation of the Root at CGNET Active Directory Coverage Policies Applicable to Exchange Sites That Have Not Yet Migrated to AD Connection Agreements Cleanup Server Placement Policies Based Upon Recommendations System-Wide Migration Goal Center AD Status for Local Adoption of Exchange 2003 Center Migration Policy Prerequisites to Exchange 2003 Upgrades Center Migration Upgrade Path Root Policies Center Policies Routing Center Policies Security Addressing Routing Policy Options Star via Hub Mixed Mesh Document revision history 5/5/04 CGIAR Exchange 2003 Guidelines added 4/21/04 Initial release

6 Copyright 2004 docad.cgiar.org

7 docad.cgiar.org Home Exch 2003 Site Map Exchange 2003: 1 Specification of Architecture The following documents describe the rationale of upgrading the CGIAR Exchange structure to Exchange 2003, along with an overview of the process, including diagrams of the physical and logical architecture, and flowcharts of the process. The rationale behind the architecture will be described in the Exchange 2003 Implementation Policies and Guidelines section of documents. This includes critical decisions around Mixed NT4/Windows 2003 environment issues, migration paths and routing configuration, which impact the entire deployment. Please also note in the flowcharts on deployment (1.2.3) that the policy for Exchange 2003 includes the prerequisite of switching the domain to Active Directory Native Mode before deployment. Due to issues around legacy applications, etc., this may push back the Exchange 2003 projected deployment for any center that has not completed their AD upgrade. In addition, on a system-wide basis, the existence of a mixed NT4/Windows 2003 environment necessitates the creation of inter-domain AD connections agreements and the resulting object cleanup issues. In light of these issues, it is important that most centers with large numbers of users have migrated to Active Directory before the first center migrates their users to Exchange These issues are covered in the Implementation Policies and Guidelines section of the documentation. 1. Rationale 2. Diagrams Home 2 Implementation Policies and Guidelines 3 Case Histories from the CGIAR Centers Document revision history 5/5/04 Initial release

8 Copyright 2004 docad.cgiar.org

9 docad.cgiar.org Home Exch 2003 Site Map Prev Next Exchange 2003: 1 Specification of Architecture 1.1 Rationale The rationale for upgrading the CGIAR messaging network to Exchange 2003 is to take advantage of the enhanced messaging and server performance, lower cost, and enable site consolidation. One of the compelling justifications for upgrading from Exchange 5.5 is that mainstream support for Exchange 5.5 ended on December 31, It is, however, possible to take advantage of extended support that covers January 1, 2004 to December 31, Microsoft is offering the first year of this extended support at no charge. This offer gives a center the flexibility to plan for Exchange Server 2003 deployment within its schedule and budget. Because Exchange Server 2003 handles network traffic more efficiently, it can make server consolidations feasible, and help an organization see a greater return on IT investments. The scope of this project is the CGIAR s migration from an Exchange 5.5 messaging infrastructure to an Exchange 2003 network with Windows 2003 Active Directory. The list below details some of the network benefits available after the CGIAR s Exchange 2003/ Windows 2003 migration: User Benefits Outlook Web Access 2003 includes improved user interface and improved performance, especially over slow connections. The amount of data that needs to be sent from server to browser has been reduced and compression support for OWA 2003 can be configured. More Outlook functionality has been added such as in the areas of spell checking, task management, and spam filtering. Exchange 2003 supports offline cached Exchange mode when accessed via Outlook Outlook 2003 operates primarily on a cached copy of a user's mailbox, allowing users to work from cached data during periods of intermittent or lost network connectivity. Outlook 2003 reduces the traffic from client to server, thereby reducing the server load per user and enabling more users to be supported per server. Configuration of the RPC over HTTP feature in Windows 2003 allows remote users to access the Exchange 2003 server via Outlook without the need for VPN. The client must be running Outlook 2003 on a

10 Microsoft Windows XP Service Pack 1 (SP) or later-based computer. IT Administrator Benefits The Volume Shadow Copy service in Windows Server 2003 provides almost instantaneous backup and restore, thus removing one of the practical limits to the number of users supported on a single server the time it takes to back up the mail storage. It also enables online backup of Exchange Storage Groups, so there's no need to take systems offline. This requires third-party backup software. Recovery Storage Group provides greater flexibility when restoring mailboxes and mailbox stores. Exchange 2003 provides a Recovery Storage Group feature, a specialized storage group that can exist alongside the regular storage groups in Exchange. The Recovery storage group allows for restoration to a test environment on the production server itself. You can only use the Recovery Storage Group to recover mailbox stores, not public folder stores. Windows Server 2003 also contains several improvements to support Storage Area Networks, including improvements in handling fiber channel, volume connection, and ability to start from a Storage Area Network. Synchronization is faster and more reliable, as the client-to-server communication protocol has been rewritten and optimized for an impressive gain in efficiency. Thus Exchange 2003 can reduce the number of remote offices that need to be equipped with Exchange servers. A common directory is shared between Exchange Server 2003 and Windows 2003 Server. Public folder contents are available from within the Exchange System Manager. OWA also includes improved security measures. Administrators can configure OWA to time-out a user's OWA session after a period of inactivity, minimizing the possibility of a security breach due to unattended browser sessions. Document revision history 5/5/04 Initial release Prev Next Exchange 2003: 1 Specification of Architecture Copyright 2004 docad.cgiar.org

11 docad.cgiar.org Home Exch 2003 Site Map Prev Next Exchange 2003: 1 Specification of Architecture 1.2 Diagrams The following diagrams outline the flow as well as the logical and physical structure of the Exchange 2003 deployment in the contexts below: 1. CGIAR Exchange 5.5 Exchange 2003 Mail Flow Coexistence 2. CGIAR Exchange 5.5 Exchange 2003 Migration Stages 3. Flowchart of System-Wide Exchange 2003 Migration Process Document revision history 5/5/04 Initial release Prev Next Exchange 2003: 1 Specification of Architecture Copyright 2004 docad.cgiar.org

12

13

14

15 docad.cgiar.org Home Exch 2003 Site Map Exchange 2003: 2 Implementation Policies and Guidelines The following documents recommend policies and guidelines for the deployment of Exchange 2003 in the CGIAR messaging structure. This includes naming conventions, site preparation, migration paths, routing options, and monitoring. 1. Exchange Naming Conventions 2. Licensing Policies 3. Acceptable Software Versions 4. Architecture Policies 5. Migration Policies 6. Windows 2003 Preparation and Upgrade Procedure Guidelines 7. Exchange 2003 Preparation and Upgrade Procedure Guidelines 8. Exchange 2003 System Monitoring Recommendations Home 1 Specification of Architecture 3 Case Histories from the CGIAR Centers Document revision history 5/5/04 Initial release Copyright 2004 docad.cgiar.org

16 docad.cgiar.org Home Exch 2003 Site Map Prev Next Exchange 2003: 2 Implementation Policies and Guidelines 2.1 Exchange Naming Conventions Because the Directory that used to be the integral part of Exchange 5.5 has been migrated into the Active Directory under Exchange 2003, many of the factors surrounding naming conventions have been already determined within the Windows 2000 Active Directory upgrade process. There are, however, a few new restrictions incorporated into Exchange 2003 that a migration must take into consideration. Distribution Group Names The naming conventions for distribution groups include the requirement that the name of the Center appear first, for example ILRI-FINANCE. This is in order to prevent confusion by users selecting from large drop down lists. It is important to use a descriptive name for the group. Group names must be unique to the Active Directory. CGIAR Address Names Recipients require an SMTP address that is unique across the forest and the Internet. Note - Eventually the internal form of the address as currently used in the Exchange 5.5 system will go away to be replaced by an internal address matching the external form of the address. In other words the internal address will transition to f.last@cgiar.org addressing. Exchange will not allow the creation of duplicate addresses in the forest, so at the time of the addressing cutover, the Exchange server administrators will be responsible for the creation of the new cgiar.org addresses in accordance with the CGIAR naming conventions document. CGIAR Public Folder Names Although not an Exchange technical requirement, we have seen through experience that public folder names should be unique to the Exchange organization. While previously allowed in Exchange 5.5, Ampersands (&) and Asterisks (*) are illegal characters in Exchange In general, naming convention should simplify user s access to these machines.

17 CGIAR Exchange Server Names 15 character limit, A-Z, a-z, 0-9, - are legal characters. While previously allowed in Exchange 5.5, Ampersands (&) and Asterisks (*) are illegal characters in Exchange In general, naming convention should simplify user s access to these machines. Complying With Name Restrictions in Exchange 2003 The Exchange Server 2003 store uses the following two types of databases, which are Mailbox stores and Public Folder stores. These databases are organized into storage groups. If you are using Exchange Server 2003 Standard Edition, each server that is running Exchange Server 2003 Standard Edition can have one storage group. If you are using Exchange Server 2003 Enterprise Edition, each server that is running Exchange Server 2003 Enterprise Edition can have up to four storage groups. Each storage group can contain up to five databases (either mailbox stores or public folder stores). Storage group names cannot be greater than 64 characters in length. When a new user is created in Active Directory, the Full name field is always generated in FirstName LastName format. Therefore, in Exchange 2003, the Global Address Lists are formatted to sort the objects by the Display Name field in Active Directory. However, the Display Name field in Active Directory takes the format of FirstName LastName and therefore when your users open the Address List in their mail client, the recipients are sorted by First Name. It is possible to use ASDIedit to change the Address List sort such that they will appear in the LastName FirstName format. Please refer to Changing the Display Order in the Exchange 2000 Address List for instructions on modifying the sort order. Summary Group names must be unique in Active Directory. addresses must be unique. Ampersands (&) and Asterisks (*) are illegal characters in Exchange The use of short, user-friendly DNS names for Exchange server names is advisable. Active Directory Address List sort order can be modified. Additional Recommendations Use names that are short enough to remember. Length should not be a significant deciding factor when choosing names.

18 Users typically interact with the global catalog and are not concerned with domain names. Typically, only administrators are exposed to domain names. Administrative tools almost always present a list of domains to choose from, and the number of cases where an administrator has to type a full name will be the exception, not the rule. In general, if you can remember all the components of a name then it is not too long. Review names internationally. Names that have a benign or useful meaning in one language can sometimes be derogatory or offensive in another language. DNS is a global namespace; be sure to review your names globally within your organization. Document revision history 5/5/04 Initial release Prev Next Exchange 2003: 2 Implementation Policies and Guidelines Copyright 2004 docad.cgiar.org

19 docad.cgiar.org Home Exch 2003 Site Map Prev Next Exchange 2003: 2 Implementation Policies and Guidelines 2.2 Licensing Policies The following documents provide an overview of licensing recommendations. Since Microsoft licensing options and pricing can change with time, it is best to check the latest information on the Microsoft web site. 1. Windows Server 2003 Licensing 2. Exchange Server 2003 Licensing 3. Windows Server 2003 Activation Document revision history 5/5/04 Initial release Prev Next Exchange 2003: 2 Implementation Policies and Guidelines Copyright 2004 docad.cgiar.org

20 docad.cgiar.org Home Exch 2003 Site Map Prev Next Exchange 2003: 2.2 Licensing Policies Windows Server 2003 Licensing Records of the licenses in use by the CGIAR Active Directory forest should be traced and regularly maintained. This document describes Microsoft s licensing model around the commons licenses used by organizations such as the CGIAR. For most purposes in the organizational environment, the Per Device (formerly called Per Seat ) or the new Per User type of licensing is more economical. Supported Paths for Upgrading to Windows Server 2003 It is important to note that Microsoft does not support loss of functionality in its upgrade schema. What this means is that you cannot perform an In-Place upgrade of the Enterprise Edition of software to the Standard Edition. For example, Windows NT Server 4.0 Enterprise Edition can be upgraded to Windows Server 2003 Enterprise Edition, but it cannot be upgraded to Windows Server 2003 Standard Edition. Whereas Windows NT Server 4.0 Standard Edition can be upgraded to either of the following: Windows Server 2003 Standard Edition Windows Server 2003 Enterprise Edition. Similarly, Windows Server 2000 Standard Edition can be upgraded to any of the following: Windows Server 2003 Standard Edition Windows Server 2003 Enterprise Edition Windows Small Business Server 2003 Standard Edition Windows Small Business Server 2003 Premium Edition, but Windows Server 2000 Enterprise Edition can only be upgraded to Windows Server 2003 Enterprise Edition.

21 For details on supported paths for various platforms to Windows 2003, please see Supported Paths for Upgrading to Windows Server The Windows Server 2003 Licensing Model Although there have been changes to the Windows Server 2003 licensing model, the following elements have not changed: Every installed copy of the server software requires the purchase of a Windows server license. A Windows Server 2003 Client Access License (Windows CAL) is required in order to access or use the server software. A Windows CAL is not required if access to the server software is via the Internet and is "unauthenticated". For example, accessing a Web site for general information where no identifying credentials are exchanged. A Terminal Server Client Access License (TS CAL) is required to use Terminal Server or otherwise host a remote graphical user interface (GUI) session, except for a console session. A Windows CAL (Device or User CAL) can still be designated for use with a single server, authorizing access by any device or user, when the server software's licensing mode is set in "Per Server" mode. In this mode, the number of Windows CALs is equal to a maximum number of concurrent connections. Or, a Windows CAL (Device or User CAL) can be designated for use with any number of servers, authorizing access by a specified device or user, when the server software's licensing mode is set in "Per Device or Per User" mode (formerly called "Per Seat" mode). The main distinctions between Per Server and Per User/Per Device (formerly Per Seat ) modes are listed below. Per User/Per Device mode: A separate Windows CAL (of either type) is required for each user or device that accesses the server software on any of your servers. The number of Windows CALs required equals the number of users or devices accessing the server. Per User/Per Device mode tends to be the most economical mode for Windows CALs in distributed computing environments where multiple servers within an organization provide services across most devices or users. Per Server mode: A separate Windows CAL (of either type) is required for each user or device that accesses the server software on any of your servers. The number of Windows CALs required equals the maximum number of users or devices that may simultaneously access the server software installed on a particular server.

22 Per Server mode tends to be the most economical for Windows CALs in computing environments where a small number of servers have limited access requirements. For more details on Microsoft s Windows 2003 licensing model and pricing, please see Windows Server 2003 Client Access Licensing Overview and Windows Server 2003 Pricing. Changes to Windows Server 2003 Licensing The main changes in Windows Server 2003 licensing are outlined below: New External Connector License option - The new External Connector license (EC) can be purchased to enable access to your servers instead of buying individual Windows CALs for external users (or their devices). An EC license is purchased for every copy of the Windows server software that is accessible to the external user. Terminal Server CAL Changes The TS CAL requirement is no longer waived for devices accessing the Terminal server that are running the same or later version of the equivalent desktop operating system. Introduction of User-based Windows CALs With the release of Windows Server 2003, there are now two types of Windows CALs to choose from: device-based and user-based, known as Windows Device CALs and Windows User CALs. This means you can choose to acquire a Windows CAL for every device (used by any user) accessing your servers, or you can choose to acquire a Windows CAL for every named user accessing your servers (from any device). Windows Device CALs might make most economic and administrative sense for an organization with multiple users for one device, such as shift workers. Whereas, Windows User CALs might make most sense for an organization with many roaming employees that need access to the corporate network from unknown devices and/or employees who access the network via multiple devices. For more details on Windows Server 2003 licensing changes, please refer to What's New in Windows Server 2003 Licensing. Windows 2003 Terminal Server Licensing In cases where Terminal Server is used in Remote Administration mode, it is not necessary to buy extra licenses, as access for two simultaneous users is included. For Terminal Server run in Applications mode, users running Windows devices can no longer access Terminal Server without an associated TS CAL. Clients will need to buy Terminal Service CALs as described in Licensing Terminal Server in Windows Server 2003.

23 Document revision history 5/5/04 Initial release Prev Next Exchange 2003: 2.2 Licensing Policies Copyright 2004 docad.cgiar.org

24 docad.cgiar.org Home Exch 2003 Site Map Prev Next Exchange 2003: 2.2 Licensing Policies Exchange Server 2003 Licensing Records of the licenses in use by the CGIAR Active Directory forest should be traced and regularly maintained. The following describes the basic Exchange licensing schemes. In addition to the purchase of the Exchange Standard or Enterprise Server license, Client Access Licenses (CALs) must be purchased to permit users to access the server software. Microsoft licensing for Exchange 2003 introduces a new type of Client Access License (CAL), a User CAL, along with the existing Device CAL and in addition to licensing the actual Exchange Server software. A Device CAL permits one device (used by any number of users) to access or use the server software. A User CAL permits one user using any device to gain access to or use the server software. Many Exchange users prefer the User CAL because it allows access to the server running Exchange from multiple devices, including computers, laptops, and mobile devices. Device CALs are useful in kiosks or shared computer environments where multiple employees use the same computer to access their and calendar information. Both Device CALs and User CALs can be used to gain access to the same server. However, for ease of management and tracking, you might consider buying CALs on either a Device or User basis. Both CALs are priced the same. An additional new External Connector license (EC) has been introduced to enable external users access to your servers running Exchange 2003 without the use of individual CALS. An EC license would be purchased for every copy of Exchange 2003 that can be accessed by the external users. Note - When buying the server license, take note of Microsoft s restrictions on supported migration paths: You cannot perform an in-place upgrade to Exchange Server 2003 Standard Edition from Exchange 2000 Enterprise Edition. In-place upgrade from Exchange Server 5.5 Enterprise Edition to Exchange 2000 Standard Edition is also not supported.

25 More information on Microsoft s enigmatic licensing schemes for Exchange can be found at How to Buy and Exchange Server 2003 Licensing FAQ (until Microsoft decides to redesign their website yet again, at which time these links will be lost). Document revision history 5/5/04 Initial release Prev Next Exchange 2003: 2.2 Licensing Policies Copyright 2004 docad.cgiar.org

26 docad.cgiar.org Home Exch 2003 Site Map Prev Next Exchange 2003: 2.2 Licensing Policies Windows Server 2003 Activation CGNET recommends activation of your Windows 2003 software immediately after installation. Microsoft Windows 2003 and comes with Microsoft Product Activation. Products that include MPA technology need to be activated with the Microsoft License Clearinghouse. It is designed to prevent unlicensed use of the software by allowing activation of the licensed software on one computer only. The activation is entirely software based. Internet activation entails the exchange of digital certificates between the user and Microsoft, whereas manual telephone activation provides the user with a 42-digit Confirmation ID. Some points to note regarding Microsoft Product Activation (MPA) are described below: The most critical aspect recommendation CGNET has regarding Microsoft Product Activation is to activate your Windows 2003 installation as soon as it is installed to avoid operational disruptions. Activation is generally required only once for the life of the product. In some cases, however, a reactivation may be necessary if a significant number of components within the computer are upgraded. For licensing issues, refer to the installation's EULA for more details. Following an activation through the Microsoft Licensing Clearinghouse, the software will check at various points to make sure that it is activated. In Windows, this check occurs each time a user logs on to the computer, and in Office, the OAW checking occurs each time an Office application is started. The distinctions between how the activation grace periods for Windows and Office are described below. Office Activation Wizard (OAW) An end user can run Office applications a total of fifty times without having to activate Office. If the user does not activate within fifty launches of any combination of Office applications, the user's license rights are limited under the terms of the EULA and Office switches into a reduced functionality mode. Uninstalling and then reinstalling Office does not reset this value. Windows Product Activation (WPA) A user can run Windows for 30 days before being required to activate the

27 product upon their next logon procedure. If the user does not activate by the end of the grace period, they are required to do so upon the next logon procedure. Typical Windows functionality will not be accessible until activation is successfully completed. For more information regarding Microsoft product activation, please refer to Description of Microsoft Product Activation. Document revision history 5/5/04 Initial release Prev Next Exchange 2003: 2.2 Licensing Policies Copyright 2004 docad.cgiar.org

28 docad.cgiar.org Home Exch 2003 Site Map Prev Next Exchange 2003: 2 Implementation Policies and Guidelines 2.3 Acceptable Software Versions Operating System Considerations CGNET has the following upgrade recommendations: Install Exchange Server 2003 on a member server running Windows Server Only upgrade to Exchange Server 2003 after Windows Server 2003 is running on all domain controllers in the domain. Exchange Server 2003 can actually be run on the following operating systems: Windows Server 2003 (either Standard or Enterprise) or Windows 2000 Server Service Pack 3 (SP3) and later. Exchange Server 2003 is supported in the following Active Directory environments, as long as the Domain controllers and global catalog servers are running either Windows Server 2003 or Windows 2000 Server SP3: domains with either Windows 2000-based domain controllers, Windows 2003-based domain controllers or a mixture of these types of domain controllers. Exchange Server 2003 can be run in the mixed or Windows 2000 environments described above. However, it is recommended that all DC s within the domain are running Windows Server 2003 and that Exchange Server 2003 is installed on a Windows 2003 member server, in order to benefit from the optimization and features that are only available when Exchange is run in a Windows 2003 domain. Comparing Editions of Windows Server 2003 For the CGIAR Active Directory deployment, it is recommended that the AD hub and Centers use Windows 2003 Server Standard Edition to balance costs and features. For centers considering the Enterprise Edition, some distinctions between the editions are noted below. Both Standard and Enterprise versions of Exchange 2003 can be run on either Standard or Enterprise versions of Windows 2003, so this will not be a factor in choosing the edition.

29 The main ways that Windows Server 2003, Enterprise Edition, differs from Windows Server 2003, Standard Edition is its ability to cluster servers for greater load handling and fault tolerance, its support for high-performance servers (Eight-way symmetric multiprocessing vs. four-way symmetric multiprocessing for Windows 2003, Standard Edition) and support for up to 32 gigabytes (GB) of RAM versus 4 GB of RAM for Windows 2003 Standard Edition. Compare the Editions of Windows Server 2003 provides a comprehensive table comparing the features of the Windows 2003 Standard, Enterprise, Datacenter, and Web Editions, including factors such as 64-Bit support, RAM maximums, Terminal Services support, Clustering, Shadow Copy, etc. Please note that Enterprise versions of NT4 or Windows Server cannot be upgraded In-Place to Standard versions of Windows Please see Supported Paths for Upgrading to Windows Server Recommendations around other Software Running under Windows 2003 and Exchange 2003 CGNET recommends checking compatibility of all software that will be running under the Windows 2003 and Exchange This includes backup software, Antivirus products, third party utilities such as Blackberry, etc. Antivirus We recommend that systems be protected by an Antivirus product, such as: Trendmicro: Windows 2003: ServerProtect 5.58 Exchange 2003 Information Store: Scanmail 6.2 Exchange 2003 SMTP: Interscan 3.55 Symantec: Exchange 2003: Symantec Mail Security for Microsoft Exchange 4.5 Windows 2003: Symantec Antivirus Corporate Edition 9.0 McAfee: Windows 2003: McAfee VirusScan Enterprise 7.1 Exchange 2003: McAfee GroupShield 6.0 Backup Software We recommend an Exchange aware backup, such as: Veritas: Windows 2003: Veritas Backupexec 9.1 Exchange 2003: Veritas Backupexec 9.1+ Veritas Backupexec agent for Exchange Computer Associates International:

30 Windows 2003: BrightStor ARCserve Backup r11 for Windows Exchange 2003: BrightStor ARCserve Backup r11 for Windows+ BrightStor ARCserve Backup Agent for Microsoft Exchange Microsoft offers a tool called the Windows Application Compatibility toolkit (ACT), which is a collection of documents and tools that can help identify potential compatibility issues for applications installed on Windows 2003 server. This application is available for download from Microsoft Download Center by performing a search for application compatibility toolkit. Tracking Licenses CGNET suggests keeping track of the software licenses purchased, and keeping the license documentation and software media in a secure place. Exchange Server 2003 Standard Edition and Exchange Server 2003 Enterprise Edition CGNET recommends the Exchange 2003 Server Enterprise edition. Please note that the Standard edition has a limitation of 16GB for the size of the Information Store. Other considerations around the Exchange 2003 versions are noted below. Note - For centers planning an In-Place upgrade to Exchange 2003 from Exchange 5.5 via Exchange 2000 the following Upgrade Path restrictions hold: It is not possible to do an In-Place upgrade from Exchange 5.5 Enterprise Edition to Exchange 2000 Standard Server Edition. It is not possible to do an in-place upgrade from Exchange Server 2000 Enterprise Edition to Exchange 2003 Standard Edition. (Enterprise Editions cannot be upgraded to Standard Editions). Both Standard and Enterprise editions feature Network compression, Exchange 2003 Management Pack, Integrated support for mobile devices, Volume Shadow Copy service, Flexible Front-end/Back-end configuration options, and recovery storage group. For more details on these features, please refer to Exchange Server 2003 Edition Comparison. The following table from the article above compares the main features of the Standard and Enterprise Editions of Exchange 2003: Feature Standard Edition Enterprise Edition Storage Groups Support 1 storage group 4 storage groups

31 Number of Databases per Storage Group 2 databases 5 databases Total Database Size Exchange Clustering 16 gigabytes (GB) Not supported Maximum 8 terabytes, limited only by hardware Supported X.400 Connector Not included Included Additional Notes on Exchange and Windows Version Compatibility Although Exchange Server 2003 can be run on either a member server or on a domain controller, after installing Exchange Server 2003 on a server, do not change the role of the server. For example, if you install Exchange Server 2003 on a member server, do not use the Dcpromo tool to promote the server to a domain controller. Or, if you install Exchange Server 2003 on a domain controller, do not use the Dcpromo tool to demote the server to a member server. Changing the role of a server after you install Exchange Server 2003 may result in loss of some Exchange functionality and is not supported. Note - CGNET does not recommend installing Exchange 2003 on a domain controller if it can be avoided. When Exchange Server 2003 is running in Exchange mixed mode, it can coexist with Exchange Server 5.5 and Exchange Server You can perform an in-place upgrade from Exchange 2000 to Exchange Server 2003; however, an in-place upgrade from Exchange Server 5.5 to Exchange Server 2003 is not supported. Note - Although this In-place upgrade path from Exchange 5.5 to Exchange 2003 via Exchange 2000 is supported, CGNET recommends avoiding the In-Place upgrade path. Although Exchange 2000 Server Service Pack 2 (SP2) or later is supported in an environment with Windows Server 2003 domain controllers and global catalog servers, Exchange 2000 is not supported on Windows Server In a situation where you run Exchange 2000 on a Windows 2000-based computer, and you want to upgrade the operating system to Windows Server 2003, you must first upgrade Exchange 2000 to Exchange Server 2003, and then upgrade Windows 2000 to Windows Server Again, although the In-Place upgrade path via Exchange 2000 is supported, CGNET recommends avoiding the In-Place upgrade path. When you upgrade from Exchange 2000 to Exchange 2003, you must upgrade to the same language version of Exchange The following components are not supported in Exchange 2003:

32 Instant Messaging Service Exchange Chat Service Key Management Service They must be removed with Exchange Setup prior to the upgrade to Exchange Document revision history 5/5/04 Initial release Prev Next Exchange 2003: 2 Implementation Policies and Guidelines Copyright 2004 docad.cgiar.org

33 docad.cgiar.org Home Exch 2003 Site Map Prev Next Exchange 2003: 2 Implementation Policies and Guidelines 2.4 Architecture Policies This section describes recommendations for the configuration of Exchange 2003 across the centers. This includes placement of Exchange servers and Global catalog servers. Recommendations are also given around Routing Group issues and related connectivity options. Minimum and more realistic requirements and recommendations for Exchange server hardware are discussed. Policies for center connectors are described, and the options for routing across the Exchange organization detailed. The final segment discusses security policies that apply to all centers and topology recommendations for special configurations - front-end back-end architecture and RPC over HTTP deployment. 1. Server Placement and Configuration 2. Exchange Server Hardware 3. Routing Policy Options 4. Security Configurations Document revision history 5/5/04 Initial release Prev Next Exchange 2003: 2 Implementation Policies and Guidelines Copyright 2004 docad.cgiar.org

34 docad.cgiar.org Home Exch 2003 Site Map Prev Next Exchange 2003: 2.4 Architecture Policies Server Placement and Configuration Server Consolidation In planning Exchange server placement, network connectivity has generally been the deciding factor in determining whether or not to place an Exchange server in a remote office location. Particularly when a full-featured Outlook client environment is important, the impact of slow or intermittent network connectivity could mandate placing a local Exchange server at the site. The improvements available with Exchange more efficient handling of network traffic, faster and more reliable synchronization, compressed communication between client and server, and the availability of offline cached Exchange mode when using Outlook 2003 with Exchange 2003 these can make more server consolidations possible. Sites that formerly needed a local Exchange server may be able to support full client functionality without it, hence reducing hardware and administrative overhead. Within a site with multiple Exchange servers, the enhanced features of Windows 2003 and Exchange 2003, such as hyperthreading technology, along with the availability of multiple information stores and storage groups with Exchange 2003 may allow for a reduction in the number of Exchange servers needed to support the messaging needs within the center. The following recommendation, although not a policy guideline, should be taken into consideration at each Exchange site. Avoid running Exchange 2003 on a domain controller. Some smaller sites may be tempted, due to lack of hardware resources, to deploy Exchange 2003 on a server that also functions as a domain controller. Although this is possible, and may be justified in some circumstances, in general it is good to avoid this configuration where possible. Installing Exchange 2003 on a non-domain controller server will isolate your Exchange server from possible performance loading or other issues on the domain controller, and from easy privilege escalation that can happen when Windows domain controller access is available locally on the console. In addition, for security reasons, where possible, keep Exchange administrators out of the Domain Admin group, and vice versa.

35 Server Placement Policies The following server placement policies apply to all centers: 1. In remote offices that service more than 10 users, one Window 2003 global catalog server must be installed in each physical location that contains Exchange 2003 servers. Deploying two Windows 2003 global catalog servers for redundancy is ideal. If a physical site does not have two global catalog servers, existing domain controllers should be configured as Windows 2003 global catalog servers. 2. At least one Windows 2003 global catalog server must be installed in each domain that contains an Exchange 2003 server. Note Windows 2003 does allow for users to log on without a local global catalog server, but this applies only to Windows sites that do not contain Exchange users. The global catalog server is critical for Exchange services including log on, group membership and access to the global address list. It will still be necessary to deploy a local global catalog in any domain containing Exchange users. Other Configuration Options Administrative and Routing Groups Administrative group consolidation requires server reinstalls. In general, servers are configured into the same routing group when there is reliable and permanent network connectivity between them. And servers are separated into different routing groups when there is a need to control message flow between them, such as disabling Public folder referrals, scheduling communications, etc. Administrative groups, on the other hand, can encompass multiple physical locations and are designed for delegation of granular administrative rights to specific groups. In the case of the CGIAR migration from a Multi-site Exchange 5.5 configuration to Exchange 2003 the resulting Exchange organization will contain multiple Administrative Groups with a single Routing Group in each that matches the Ex 5.5 configuration. That is, each Exchange 5.5 site will map to a distinct Routing Group within a distinct Administrative group. Even after the conversion to Native mode, servers cannot be moved between Administrative Groups. If the multiple Administrative Group model fits the delegation of Administration required, then that s ideal. If not, then consolidation of some of the Administrative Groups might be desired. This would, unfortunately, require reinstallation of the Exchange servers into the desired Administrative Group. Routing Group Connectivity Options The recommendation of the SMTP connector for connectivity between the

36 CGIAR Routing Groups is detailed in the Center Connector Policies section of Routing Policy Options. A couple of configuration recommendations relevant to the connector are noted below. It is a good idea to limit the bridgehead servers to those servers that have fast and direct network connectivity. Consider disabling public folder referrals in overloaded link situations. By default, public folder referrals are enabled across connectors connecting routing groups. If public folder access across a routing group connector puts too much load on the link, then it may be better to disable public folder referrals. This can be done on the general page of either the Routing Group or SMTP connector. Free/Busy Servers Consider importance of up-do-date info in placement of free/busy replicas. For centers with Exchange users who regularly schedule meetings with Exchange users in different physical locations, the location of Free/Busy Servers can be an important consideration. If it is critical that users always have access to updated scheduling information, then free/busy folders should be hosted in a centralized location. If the need for up-to-date info is not as critical as the need for fast access, then free/busy information can be hosted on local Exchange servers. If users in certain locations do very frequent scheduling with the local users, it may be good to keep a local replica of their free/busy information on the local server as well. Note that the replication of changes in free/busy information from one location to another may take some time to propagate. Document revision history 5/5/04 Initial release Prev Next Exchange 2003: 2.4 Architecture Policies Copyright 2004 docad.cgiar.org

37 docad.cgiar.org Home Exch 2003 Site Map Prev Next Exchange 2003: 2.4 Architecture Policies Exchange Server Hardware Microsoft s Minimum Hardware Requirements Microsoft s minimum hardware requirements for running Microsoft Exchange 2003 Enterprise Edition are as follows: Intel Pentium or compatible 133-MHz or faster processor required; Intel Pentium or compatible 550-MHz processor recommended 256 MB of RAM; 512 MB recommended 500 MB of available space on the hard disk on which you install Exchange 2003; 200 MB on the system drive CD-ROM drive SVGA or a higher-resolution monitor Disk partitions must be formatted for the NTFS file system, not the FAT file system (this requirement applies to system partition and partitions storing Exchange binaries, transaction log files, database files, and other Exchange files) These requirements and even Microsoft s recommended suggestions for hardware are still rather minimal. The section below discusses more realistic recommendations for Exchange 2003 hardware. Realistic Requirements With Exchange, performance is greatly influenced by three factors - processor number and speed, RAM, and the disk I/O subsystem, the latter two of which are particularly important. Processors Because Exchange is a multithreaded application, it can take advantage of the power offered by machines with two or more processors. In general, installing a second processor, delivers about a 50 percent performance gain. Even small organizations should consider a dual processor configuration and larger organizations might consider multiprocessor systems. RAM Increasing memory is one of the most cost effective ways to increase an

38 Exchange Server s performance. As a general rule, the more RAM the better. Presently, a typical Exchange Server should have 1G 2G RAM as a minimum. Organizations hosting a very large number of users on a server may consider a 2 to 4 gigabyte range. Note - Any Exchange Server 2003 system with greater than 1 GB of physical RAM should include the /3GB /USERVA-3030 switches in the boot.ini file, which optimize the memory allocation for these systems. See You Must Use the /3GB Switch When You Install Exchange Server 2003 on a Windows Server 2003-Based System. Disk I/O One way to increase the fault tolerance while decreasing the processing required from the CPU is by implementing a specialized hardware solution, such as a hardware RAID or a Storage Area Network that incorporates RAID technology. Two other storage principles to keep in mind are that, in general, multiple small disks perform better than a single large disk, and storing sequentially accessed files separately reduces the amount of time required to locate data. As for capacity, when calculating the disk space necessary to accommodate the user mailboxes and public folders, be sure to figure in a good margin for growth, and if you plan to do defrags on the disk locally, then you ll need at least a 110% margin. Because fault tolerant storage is such a large and critical factor in Exchange implementations it is discussed in greater detail below. Fault Tolerant Storage Types of RAID Disk mirroring or disk striping with parity can used to prevent failure from the loss of a single physical hard disk. A quick description of the various RAID options is shown below. RAID-0+1 is the most reliable solution of the three because two or more disks must fail before data is potentially lost. The RAID-0+1 implementation is the most expensive because it requires twice as much disk space as is actually needed. However, this configuration also yields much higher performance than the same-capacity RAID-5 configuration, as judged by the maximum read and write rates. RAID-5 is the most cost effective solution, providing a high degree of reliability. In Exchange situation with normal demands users will not perceive any difference in performance between systems using RAID-5 and RAID-0+1. Non-Database Servers Servers that do not host mailboxes or public folders, such as connector servers, may not benefit from advanced storage solutions, so you might prefer RAID-0 (no redundancy) configuration for these types of servers. Separation of Transaction Logs and Database Files

39 One of the most critical components of a dependable Exchange storage design is the separation of transaction logs and database files. Because transaction log files and database files are critical to the operation of a server running Exchange, the transaction log files and database files of the Exchange storage group should, whenever possible, be kept on separate physical drives. A RAID-0+1 configuration (mirrored and striped) or RAID 1 (mirrored) is recommended. Complete recovery - If you keep your Exchange databases and transaction log files on the same physical hard disk and that disk fails, you can recover only the data that existed up to your last backup. Losing the hard disk containing the transaction log files is more dangerous than losing the hard disk containing the databases because you cannot replay transactions that are recorded to log files but not recorded to the physical database files on disk. This increases the chance of losing data that is not preserved in either the log files or in the last backup. Performance - In addition to increasing fault tolerance another reason to separate the transaction log files (sequential I/O) from the databases (random I/O) is to maximize performance. Separation of Storage Groups Each storage group generates its own set of transaction log files. The performance and fault tolerance of Exchange servers can be significantly improved by placing each set of transaction log files on a separate drive. Ideally the drives should be protected against failure by hardware mirroring using RAID. A RAID-0+1 configuration (mirrored and striped) or RAID 1 (mirrored) is recommended. You can minimize the time it takes to recover from a hard disk failure if you keep each of your Exchange storage groups on a separate hard disk. If only one disk fails and you have each storage group located on a separate physical hard disk, you need only to restore the storage group that is kept on the failed disk. Database Files The database files, including the mailbox and the public folder stores should also be stored on drives protected by RAID. Reliability is the most important factor in selecting storage for these files. After reliability, selection of a storage solution is based on a choice between optimizing performance (RAID-1) and optimizing capacity (RAID-5). An expensive solution would use RAID-1 (or RAID-0+1) for these files. A more cost effective solution is to use RAID-5. Example configurations of a cost effective reliable disk configuration and of a higher cost, higher reliability system are shown below. Example Configurations An example a cost effective disk configuration is as follows: C: System and boot, page file (RAID-1, RAID-0+1, or RAID-5) D: Transaction log files for all storage groups (RAID-1, RAID-0+1, or