Guide to the Secure Configuration and Administration of Microsoft ...

Do not enter a description for the account
It is important to create this account prior to installation, as the installation routine will ask
the installer to enter the Exchange Services Account name and password.
Create Windows NT Exchange Administrator’s Group
Installation
In order to simplify the assignment of administrative rights to the Exchange Server, it is
recommended that a separate Windows NT Exchange Administrators Group be
established. It is strongly recommended that you do not use the Windows NT
administrator group, as it is not necessary to have Windows NT administrative rights for
many Exchange administration functions.
Having a separate Exchange Administration Group, or Groups, offers several benefits.
First, it will preclude the need for Exchange administrators to log in unnecessarily as a
Windows NT administrator -- something that should be avoided for security reasons.
Second, it will allow you to partition administrative rights. You may reserve the right to
reconfigure the Exchange server to a select few, while allowing several individuals to
manage mailboxes, for example. And finally, having an Exchange administrator group(s)
will simplify the process of managing administrative rights -- adding a new administrator
is as simple as making them part of the appropriate Exchange administrator group.
When creating Exchange Administrator Group(s):
Do not use the Windows NT administrator’s group.
Consider partitioning Exchange Administrative rights through the use of multiple
Exchange Administrative groups.
When installing the Exchange Server, the following guidelines are recommended in
regards to where file location and the installation service packs and hot fixes.
Do not install the Exchange Server on the same partition as the operating system.
The default permissions applied to the %SystemDrive% directory by the “Guide to
Secure Microsoft Windows NT Networks” will not allow installation of the Exchange
Server to a directory under the %SystemDrive% directory (typically C:\). If necessary
to install the Exchange Server on the same partition as the OS, simply create the
destination directory before beginning and give the Exchange services account “Full
Control”.
The information store and directory service log files should be on a physical drive
separate from the information stores and directory service themselves. These log
files can serve as a record of all transactions made since the last backup. In the
event of a loss of the drive holding the Information Store or directory service, having
the logs on a separate physical drive will help ensure the ability to restore all lost
data. In the event that the use of a separate physical drive is not feasible, using a
6