Exchange Server 2013 administration overview : Exchange Server and Windows

2/23/2014 8:28:27 PM

When you install Exchange Server on a server operating system, Exchange Server makes extensive modifications to the environment. These modifications include new system services, integrated authentication, and new security groups.

Services for Exchange Server

When you install Exchange Server and Forefront Protection for Exchange Server on Windows, multiple services are installed and configured on the server. Table 1 provides a summary of key services, how they are used, and which server components they are associated with.

Table 1. Summary of key services used by Exchange 2013

SERVICE NAME	DESCRIPTION
IIS Admin	Enables the server to administer the IIS metabase. The IIS metabase stores configuration information for web applications used by Exchange. All roles need IIS for WinRM and remote Powershell. CAS needs IIS for Outlook Web App and Web services.
Microsoft Exchange Active Directory Topology	Provides Active Directory topology information to Exchange services. If this service is stopped, most Exchange services will not be able to start.
Microsoft Exchange Anti-Spam Update	Maintains the anti-spam data for Forefront Protection on an Exchange server.
Microsoft Exchange DAG Management	Provides monitoring services for Database Availability Groups, including monitoring of storage management and database layout management. (Only applies to Exchange 2013 with CU2 or later.)
Microsoft Exchange EdgeSync	Provides EdgeSync services between Mailbox and Edge servers.
Microsoft Exchange Frontend Transport	Proxies inbound and outbound SMTP connections.
Microsoft Exchange IMAP4	Provides IMAP4 services to clients.
Microsoft Exchange IMAP4 Backend	Provides IMAP4 services to mailboxes.
Microsoft Exchange Information Store	Manages the Microsoft Exchange Information Store. This includes mailbox stores.
Microsoft Exchange Mailbox Assistants	Manages assistants responsible for calendar updates, booking resources, and other mailbox processing.
Microsoft Exchange Mailbox Replication	Enables online mailbox moves by processing mailbox move requests.
Microsoft Exchange Mailbox Transport Delivery	Receives mail items from the Transport service and ensures they are processed and then delivered into mailbox.
Microsoft Exchange Mailbox Transport Submission	Receives mail items being sent and ensures they are converted from MAPI to MIME and then submitted to the Transport service.
Microsoft Exchange POP3	Provides Post Office Protocol version 3 (POP3) services to clients.
Microsoft Exchange POP3 Backend	Provides Post Office Protocol version 3 (POP3) services to mailboxes.
Microsoft Exchange Protected Service Host	Provides a secure host for Exchange Server services.
Microsoft Exchange Replication Service	Provides replication functionality used for continuous replication.
Microsoft Exchange RPC Client Access	Manages client remote procedure call (RPC) connections for Exchange Server.
Microsoft Exchange Search	Handles queries and controls indexing of mailboxes to improve search performance.
Microsoft Exchange Server Extension for Windows Server Backup	Provides extensions for Windows Server Backup that allow you to back up and recover Exchange application data using Windows Server Backup.
Microsoft Exchange Service Host	Provides a host for essential Exchange services.
Microsoft Exchange Throttling	Provides throttling functions to limit the rate of user operations.
Microsoft Exchange Transport	Provides mail transport for Exchange Server.
Microsoft Exchange Transport Log Search	Provides search capability for Exchange transport log files.
Microsoft Exchange Unified Messaging	Enables voice and fax messages to be stored in Exchange and gives users telephone access to email, voice mail, the calendar, contacts, or an automated attendant.
Microsoft Exchange Unified Messaging Call Router	Provides capabilities necessary for routing calls.
Secure Socket Tunneling Protocol Service	Provides support for Secure Socket Tunneling Protocol (SSTP) for securely connecting to remote computers.
Web Management Service	Enables remote and delegated management for the web server, sites, and applications.
Windows Remote Management Service	Implements the WS-Management protocol. Required for remote management using the Exchange console and Windows PowerShell.
World Wide Web Publishing Services	Provides web connectivity and administration features for IIS.

Exchange Server authentication and security

In Exchange Server 2013, email addresses, distribution groups, and other directory resources are stored in the directory database provided by Active Directory. Active Directory is a directory service running on Windows domain controllers. When there are multiple domain controllers, the controllers automatically replicate directory data with each other using a multimaster replication model. This model allows any domain controller to process directory changes and then replicate those changes to other domain controllers.

The first time you install Exchange Server 2013 in a Windows domain, the installation process updates and extends Active Directory to include objects and attributes used by Exchange Server 2013. Unlike earlier releases of Exchange Server, you do not use Active Directory Users And Computers to manage mailboxes, messaging features, messaging options, or email addresses associated with user accounts. You perform these tasks using the Exchange management tools.

Exchange Server 2013 fully supports the Windows Server security model and by default relies on this security mechanism to control access to directory resources. This means you can control access to mailboxes and membership in distribution groups and you can perform other Exchange security administration tasks through the standard Windows Server permissions set. For example, to add a user to a distribution group, you simply make the user a member of the distribution group in Active Directory Users And Computers.

Because Exchange Server uses Windows Server security, you can’t create a mailbox without first creating a user account that will use the mailbox. Every Exchange mailbox must be associated with a domain account—even those used by Exchange for general messaging tasks. In Exchange Admin Center, you can create a new user account as part of the process of creating a new mailbox.

You use Exchange Admin Center to manage Exchange servers according to their roles and the type of information you want to manage.

Exchange Server security groups

Exchange Server 2013 uses predefined universal security groups to separate administration of Exchange permissions from administration of other permissions. When you add an administrator to one of these security groups, the administrator inherits the permissions permitted by that role.

The predefined security groups have permissions to manage the following types of Exchange data in Active Directory:

Organization configuration data . This type of data is not associated with a specific server and is used to manage databases, policies, address lists, and other types of organizational configuration details.
Server configuration data . This type of data is associated with a specific server and is used to manage the server’s messaging configuration.
Recipient configuration data . This type of data is associated with mailboxes, mail-enabled contacts, and distribution groups.

The predefined groups are as follows:

Compliance Management . Members of this group have permission to configure compliance settings.
Delegated Setup . Members of this group have permission to install and uninstall Exchange on provisioned servers.
Discovery Management . Members of this group can perform mailbox searches for data that meets specific criteria.
Exchange Servers . Members of this group are Exchange servers in the organization. This group allows Exchange servers to work together.
Exchange Trusted Subsystem . Members of this group are Exchange servers that run Exchange cmdlets using WinRM. Members of this group have permission to read and modify all Exchange configuration settings as well as user accounts and groups.
Exchange Windows Permissions . Members of this group are Exchange servers that run Exchange cmdlets using WinRM. Members of this group have permission to read and modify user accounts and groups.
Help Desk . Members of this group can view any property or object within the Exchange organization and have limited management permissions, including the right to change and reset passwords.
Hygiene Management . Members of this group can manage the anti-spam and antivirus features of Exchange.
Managed Availability Servers . Every Exchange 2013 server is a member of this group. Managed availability is new for Exchange 2013. It’s an internal process that provides native health monitoring and recovery for protocol processes to ensure availability of Exchange services.
Organization Management . Members of this group have full access to all Exchange properties and objects in the Exchange organization.
Public Folder Management . Members of this group can manage public folders and perform most public folder management operations.
Recipient Management . Members of this group have permissions to modify Exchange user attributes in Active Directory and perform most mailbox operations.
Records Management . Members of this group can manage compliance features, including retention policies, message classifications, and transport rules.
Server Management . Members of this group can manage all Exchange servers in the organization but do not have permission to perform global operations.
UM Management . Members of this group can manage all aspects of unified messaging, including Unified Messaging server configuration and unified messaging recipient configuration.
View-Only Organization Management . Members of this group have read-only access to the entire Exchange organization tree in the Active Directory configuration container and read-only access to all the Windows domain containers that have Exchange recipients.

Others

- Exchange Server 2013 administration overview : Exchange Server 2013 editions

- Exchange Server 2013 administration overview : Exchange Server 2013 and your hardware

- Exchange Server 2013 administration overview : Getting started with Exchange 2013 and Exchange Online

- Microsoft Lync Server 2013 Monitoring and Archiving : Archiving Configuration (part 2) - Using Cmdlets for Configuration Tasks

- Microsoft Lync Server 2013 Monitoring and Archiving : Archiving Configuration (part 1) - Creating Site and User Policies

- Microsoft Lync Server 2013 Monitoring and Archiving : Monitoring Components Installation (part 2) - Monitoring Administration

- Microsoft Lync Server 2013 Monitoring and Archiving : Monitoring Components Installation (part 1) - Monitoring Configuration

- Sharepoint 2013 : Packaging and distributing apps (part 5) - Trapping app lifecycle events

- Sharepoint 2013 : Packaging and distributing apps (part 4) - Installing apps at tenancy scope

- Sharepoint 2013 : Packaging and distributing apps (part 3) - Publishing apps