Nice article, thanks for the writeup. Now if only we could move those Exchange groups into a different OU/Container than 'Users'. :)

Exchange-faq.dk - Din portal til Microsoft Exchange Server information

Thanks for the writeup. It makes a lot of sense.
I have some questions though:
a)Does the RUS re-apply the Exchange GPO to assign specific rights to the Enterprise servers group, every time it runs?
b) How can I identify which DC/GC that is currently used by an Exchange server?

Thanks
/Dung

Good Questions and I don't know the answers because that's a little out of my area. However I do know someone who wrote part of that code so I asked him (one of the benefits of working here at MS). Here is his reply:

a. No, it only applies policies when the objects change.

b. Look at the Enterprise RUS properties. If that DC is gone, the RUS will log a message saying so and pick a random DC. I’m not sure what the event id is.

A question came up on whether this applies to all domains that have GCs in them, not just the root domain.

The more precise answer is “All GCs in the same Windows site as an Exchange Server should be prepped”. Since DSAccess uses the site boundary (not domain) for choosing local GCs, all in-site GCs should be accessible.

Nice artice thanks,

When I ran domainprep I got the error that my mail server was not in the exchange domain server group - adding the mail server to this group soon solved the problem but ........

What can cause domainprep to run without error but not add the server into this group ?

DomainPrep does not add any servers to the Exchange Domain Servers group. It can't because at the time DomainPrep is run there are no Exchange servers (of the same Exchange version) in that domain because you can't install an Exchange server without first running DomainPrep. Plus DomainPrep can be run from any server in the domain, whether or not you plan on installing Exchange on that particular server, so there's no way for DomainPrep to know what machine account to add to the group.

The Exchange Domain Servers (EDS) group gets populated with the Exchange server's machine account when Exchange is installed on that server. Only Exchange Full Administrators at the Org level can install an Exchange Server and add the machine account to the EDS automatically because they have been granted this permission during DomainPrep or by the Delegation Wizard.

If you run Exchange Setup using an account that has Exchange Full Administrator rights at the Administrative Group level (not the Org) then you will get a prereq message saying you need to fist manually add the machine account to the EDS before continuing. Without being able to see your Exchange Server Setup Progress log, I'm going to guess the error you're seeing is really this prereq.

Thanks for the quick response.
Just to tie up the loose ends I was installing Exch 2003 via the CD "steps" - after running domainprep it asks you to run orgprepcheck which gives you the above error in the log file it creates.

If the account is placed there during exchange setup then this part of the orgprepcheck is a little early and will always cause an error ?

Ah yes, the OrgPrepCheck tool. That explains it.

Yes, the OrgPrepCheck tool runs a number of tests and one of them is to see if the local server is joined to the local domain's Exchange Domain Servers group. That particular test is, as you pointed out, too early and will always have this warning. However, in the logs there is a little disclaimer that says "If the local computer is not running Exchange Server 2003, this is not a problem". So as long as you don't have Exchange Server installed on that server yet, you can safely ignore this warning in the OrgPrepCheck tool.

If you run OrgPrepCheck after installing Exchange on the server and you are still getting the error, then there would be a problem because the server wouldn't be getting added to the EDS as expected. Just be sure you are pointing OrgPrepCheck at the Domain this Server is joined to, prior to running the tool.

I had one question.. what if Exchange server was installed without running domainprep?? what would that cause?? and is it ok to run domainprep now on the DC after exchange has been iistalled?

Tarek,

If you do not run the /domainprep separately, the Setup will actually run it for you as Exchange will not work if /domainprep was not run in it's local domain. The reason we recommend to run them separately is to let the AD replication to stabilize before running the full setup (which could be a problem in large environments) and because running separate steps is easier to troubleshoot in cases of problems. But - if your Exchange setup completed - it also /domainprepped the domain.

Hello Tarek,

if you run Exchange setup routine and you are able to finish installation succesfully and mail flow, calendaring, ... works without problems, you can be sure that domainprep was executed in the background.

You should in a new install first run setup /forestprep, then setup /domainprep and in big environments start the installation of Exchange on the next day.

You can also check if the group Exchange Domain Servers is a member of Exchange Enterprise Servers and if Exchange Enterprise Servers has Read to f. ex. Domain users, ...

Yes, you can rerun domainprep. Take a look at:
http://support.microsoft.com/default.aspx?scid=kb;en-us;262068

Kind Regards,

After my session at the TechNet roadshow yesterday, I  promised I'd make available all the links...