The only way to establish strict boundaries between business units is to create a separate Active Directory forest for each business unit. If this is your Active Directory configuration, we recommend that you use an Exchange resource forest.

Figure 1 illustrates an example of a complex Exchange organization that contains an Exchange resource forest.

In Figure 1, Forest B contains Exchange servers, and Forest A contains the user accounts. Forest B also contains identical user accounts, but those accounts are disabled, and mailbox-enabled users log on to Active Directory using their account in Forest A.

If you deploy Exchange 2007 in a resource forest, the administrator in the forest that only contains the user accounts does not have permission to create mailboxes in the Exchange forest by default. Although the administrator in the forest that contains user accounts can create user accounts, in a resource forest topology, this administrator cannot perform any mailbox management tasks without delegating special permissions to the account administrator. An administrator in the Exchange forest must manually create mailboxes separately from the user accounts and link the mailboxes back to existing user accounts. In addition, you must also add any additional information (such as telephone number or office location) to the Exchange forest separately, even though that information may already exist with the associated user account.

In the case of mergers and acquisitions, it is not uncommon to have multiple Active Directory forests and multiple Exchange organizations. When running Exchange in a multiple forest environment, system architects and Exchange administrators generally encounter the same design issues found in the simple, standard, and large Exchange organization models. However, unique to the complex Exchange organization is the need to synchronize directory objects across disparate forests, and to replicate free/busy data. Microsoft provides two solutions for directory synchronization:

• Identity Integration Feature Pack for Microsoft Windows Server Active Directory (IIFP) with Service Pack 2 (SP2)
  
• Microsoft Identity Integration Server (MIIS)
  

Both solutions are based upon MIIS. IIFP is a freely available, simpler version of MIIS. MIIS is a feature-rich, though more costly, solution.

In addition to synchronizing the directory, a frequent requirement is that free/busy data or public folders be made available between the Exchange organizations that are hosted in each forest. In previous versions of Exchange Server, this required the use of the Microsoft Exchange Server Inter-Organization Replication (IORepl) tool, which allowed for the coordination of meeting, appointments, contacts, and public folder information between disjointed Exchange organizations. To share free/busy and calendaring information between Exchange 2007 organizations that are hosted in separate forests, you can:

• If both organizations use Microsoft Office Outlook 2007, the Availability Service in Exchange 2007 can be used to share free/busy and calendaring information between the organizations. However, this solution does not share public folder data between the organizations.
  
• If earlier versions of Outlook are being used, you can use IORepl to share free/busy and calendaring information between the organizations. It is supported to install IORepl on a computer that has the Exchange 2007 management tools installed without any other Exchange 2007 server roles or on a server that is running Exchange Server 2003 or Exchange 2000 Server. This solution would also allow you to share public folder data between the organizations. If you install the tool on a computer that has the Exchange 2007 management tools installed, you must also install the Exchange MAPI client libraries. For more information about the Inter-Organization Replication tool, see Microsoft Exchange Server Inter-Organization Replication. For more information about downloading the Exchange MAPI client libraries, see Microsoft Exchange Server MAPI Client and Collaboration Data Objects 1.2.1.
  

For more information about how to use IORepl with Exchange 2007, see How to Use the Exchange 2003 Version of the Inter-Organizational Replication Tool with Exchange 2007.

Figure 2 illustrates an example of a complex Exchange organization that contains multiple Exchange forests.