Configuring the Exchange 2003 Cluster Nodes

To accommodate the policies applied by the Windows and Exchange security GPO templates, you must configure two components on your Exchange cluster nodes:

• Services   The Windows and Exchange security GPO templates configure some services to start automatically. You must change some of these services to start manually. In addition, you must also enable the Cluster service and the Microsoft Distributed Transaction Coordinator (MSDTC) service.

• Network Security   You must download a Windows Server 2003 post-RTM hotfix that allows NTLM version 2 (NTLMv2) session security to operate correctly in a Windows Server cluster. For more information, see Microsoft Knowledge Base article 890761, "You receive an "Error 0x8007042b" error message when you add or join a node to a cluster if you use NTLM version 2 in Windows Server 2003."

Services

The following table lists the recommended baseline startup settings for cluster nodes running in a hardened environment. Specifically, Table 1 shows the startup mode for each service after you apply the Exchange 2003 Cluster Node Base GPO template above the Exchange 2003 Backend and Windows Enterprise Client Member Server GPO templates. Services that are added or changed by the Exchange 2003 Cluster Node Base GPO template appear in italic.

To enable the POP3 or IMAP4 services, which are disabled by both the Exchange 2003 Backend and Exchange 2003 Cluster Node Base GPO templates, you must apply either the Cluster Node POP3 template (Exchange_2003-Cluster_Node_POP3_V1_1.inf) or the Cluster Node IMAP4 template (Exchange_2003-Cluster_Node_IMAP4_V1_1.inf).

Service settings configured by applying the Exchange 2003 Cluster Node Base GPO template above the Exchange 2003 Backend GPO security template

Services Added and Changed by the Exchange 2003 Cluster Node Base GPO Template

As previously mentioned, the Exchange 2003 Cluster Node Base GPO template only adds or changes services that have been configured by the Exchange 2003 Backend and Windows Member Server GPO security templates. This section describes the services that are added and changed when you apply the Exchange 2003 Cluster Node Base GPO template above the Exchange 2003 Backend and Windows Enterprise Client Member Server GPO security templates.

Because core Exchange services are controlled by the Windows Cluster service, Exchange 2003 cluster nodes require that these core services are set to start manually. The Exchange 2003 Cluster Node Base GPO template sets the following Exchange services to start manually:

• Microsoft Exchange Information Store

• Microsoft Exchange MTA Stacks

• Microsoft Exchange System Attendant

• Microsoft Exchange Routing Engine

• Simple Mail Transfer Protocol (SMTP)

Furthermore, running Exchange in a Windows cluster requires the following additional services:

• Cluster service   This service is the core Windows Clustering service and is set to start automatically. The Exchange 2003 Cluster Node Base GPO template sets auditing on the Cluster service such that any audit failures on the Cluster service (Clussvc.exe). Additionally, the template secures the Cluster service with the following security permissions:

  • Built-in Administrators: Full Control

  • Authenticated Users: Read

  • SYSTEM: Full Control

  The SYSTEM and Built-in Administrators permissions are required for the Cluster service to operate in any environment. Granting authenticated users Read access is required for Outlook Web Access. For more information about the permission specific to Outlook Web Access, see Microsoft Knowledge Base article 833001, "Users cannot access Outlook Web Access after you apply security templates from the Security Operations Guide for Windows 2000."

• Microsoft Search   This service is set to start manually. This Exchange-related service is not required; however, a Microsoft Search cluster resource is created when an EVS is created. Disabling this service results in a partially online cluster resource.

  If you do not use full-text indexing in your organization, you can delete the Microsoft Search cluster resource and then disable this service. In the Exchange 2003 Backend.inf template, which the Exchange Cluster Node OU inherits, this service is set to Disabled. Therefore, to disable the Microsoft Search service, remove the following line from Exchange_2003-Cluster_Node_Base_V1_1.inf file:

  "MSSEARCH",3,"D:AR(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"

  For more information about deleting and re-creating the Microsoft Search service resource on an Exchange 2003 cluster, see Microsoft Knowledge Base article 830189, "Exchange Server 2003 computer cannot bring the Microsoft Search resource online."

• Microsoft Distributed Transaction Coordinator (MSDTC)   This service is set to start manually. Exchange only uses the MSDTC during Setup. During Exchange Setup, COM+ is used to register the Microsoft CDO Workflow Event Sink (CDOWFEVT.DLL) so that the functions of the dll can be used. In order for COM+ to register the event sink, a clustered MSDTC resource must be installed and running in the cluster.  If a clustered MSDTC is not installed and running during Exchange Setup, or service pack Setup, then Setup will fail. For more information about configuring MSDTC, see Microsoft Knowledge Base article 301600, "How to configure Microsoft Distributed Transaction Coordinator on a Windows Server 2003 cluster."

Network Security

The Windows Member Server GPO security templates (included with the Windows Server 2003 Security Guide) enable minimum session security for NTLM security support provider (SSP)-based servers and clients. Specifically, the Windows Enterprise Client Member Server GPO template configures the following NTLM settings:

• Message integrity (encryption)

• Message confidentiality

• NTLMv2 authentication

• 128-bit encryption

NTLMv2 authentication does not operate correctly on the RTM version of Windows Server 2003 clusters. Specifically, on a Windows Server 2003 cluster, enabling NTLMv2 authentication for NTLM SSP prevents the Cluster service from starting. However, NTLM version 1 session security with message integrity, message confidentiality, and 128-bit encryption is functional. Therefore, the Windows Enterprise Client Member Server GPO security template causes Exchange cluster nodes to fail because the GPO security templates enforce NTLMv2 authentication.

To enable Exchange 2003 clustering where the Windows Member Server GPO security templates are being enforced, you must install the Windows hotfix described in the Microsoft Knowledge Base article 890761, "You receive an "Error 0x8007042b" error message when you add or join a node to a cluster if you use NTLM version 2 in Windows Server 2003."

Again, it is important to stress that applying the Exchange 2003 Cluster Node Base GPO template in isolation does not harden your Exchange environment. The Exchange 2003 Cluster Node Base GPO template assumes that both the Exchange Backend and the Windows Server 2003 Enterprise Client Member Server Security GPO security templates have been applied and are inherited by the OU where you placed your Exchange cluster nodes.