When Active Directory was introduced in Exchange 2000 Server, we found that many organizations used separate administrators for Exchange and Active Directory. This, of course, meant that there was a need to delegate administrative functions. In these scenarios, operations were decentralized so that separate teams managed aspects of Exchange and Microsoft Windows (Active Directory).
Therefore, in response to feedback from Exchange 2000 customers, we made several changes to the process of managing permissions in Exchange 2003. Specifically, Exchange 2003 provided predefined security roles. These roles were a collection of standardized permissions that could be applied at either the organization level or the administrative group level. But we found that this model presented some of the following limitations:
-
A lack of specificity. The Exchange Administrator group was too large, and some customers wanted to manage their security and permissions model at the individual server level.
-
A perception that the Exchange 2003 security roles only differed in subtle ways.
-
No clear separation between administration of users and groups by the Windows (Active Directory) administrators and Exchange recipient administrators. For example, to perform Exchange recipient-related tasks, you had to grant Exchange administrators high-level permissions (Account Operator permissions on Windows domains).