We ran into an interesting problem in Exchange 2007 Service Pack 1 where certain kinds of LDAP queries were rejected by Windows 2008 domain controllers. Exchange was changing the BaseDN attribute on successive searches, but Win2k8 is a bit more restrictive...