General discussion


why would anyone set up AD on an exchange server?

By terrorsound ·
would'nt this be a security nightmare especially since exchange is the garbage filter for the internet and antivirus\antispam is only as good as it's last update..

I'm getting techs suggesting to put AD on the exchange server and I'm totally against it, especially since I've been in the security field for a number of years now.. I would thing exchange is the first think that gets hit when scanners cannot pick up the latest threats.

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

Only reason I can think of...

by Kjell_Andorsen In reply to why would anyone set up A ...

I'm assuming that by AD you mean Domain Controller, since an Exchange Server by default has to be part of an AD environment.

Going forward with said assumption I would say the only valid reason I can see is in a very small environment where SBS is used. SBS is by default configured to be both a domain controller and Exchange server since in such situations it will often be the one and only server used by a small organization.

Once an organization outgrows SBS, there should not be any good reason to keep Exchange on a Domain controller. Servers are cheap enough these days that it makes perfect business sense to keep Exchange on it's own separate server, and not on a Domain Controller.

Collapse -

Bad idea

by CharlieSpencer In reply to why would anyone set up A ...

High transaction overhead. It might save cash up front, but the processing overload will kill you. I might do it with two virtual machines on one killer piece of hardware.

Collapse -

When the boss says so...

by J P Charland In reply to why would anyone set up A ...

When the guys signing the cheque say "We refuse to pay for this setup, find a cheaper way to do it" You cut corners, make sacrifices and hope for the best. I speak from experience...

Collapse -

I suppose

by LoonIT In reply to why would anyone set up A ...

something like this can be done without too much trouble. Using virtual server will separate the two, give your domain controller and mail server separate I.P.'s, so on and so forth. On the other hand, installing AD and exchange onto the same, say, server 03 r2 is ridiculous. There are ways to save money, this is not one of them.

Collapse -

nightmare..imagine this

by somebozo In reply to why would anyone set up A ...

AD, exchange, ISA and Symantec corporate server all one one machine..and i have migrate all of them to new hardware..

Collapse -

I can do you one better...

by cjmortant110 In reply to nightmare..imagine this

I have a Windows 2003 R2 Standard server I have to upgrade to Enterprise edition so that it can actually use the 16 GB of RAM that is installed. This was setup by a company that is no longer the IT company for our client (for obvious reasons). This server is:
A DC/GC holding the FSMO roles
An Exchange server
A SQL server hosting a database for their external website.
The SEP management server
Their file/print server

About the only thing this is NOT doing is the backups (which we have thankfully put on another server).

My delima is that I'd like to remove the DC role but have read I can't due to the Exchange install. But at the miminum I'd like to move the FSMO roles and the Global Catalog off to another DC we've setup. Unfortunately this other server will not support the Exchange as well.

Collapse -

It works ok if you have a mail gateway

by AV . In reply to why would anyone set up A ...

Our Exchange server has AD. Its one of 2 domain controllers on a Windows 2003/2000 network. It hasn't been a problem, because any spam, etc. is handled first by an outside service. Then it goes to the mail gateway and on to the Exchange server. We use the IMF on Exchange to further filter the mail.

We've never had a problem with viruses, etc. getting through. I wouldn't recommend doing that if all of your mail went directly to the Exchange server. Thats a bad idea.

I didn't get to set this network up, I just have to make it work.


Related Discussions

Related Forums