Exchange Box as DC

[keithmyers]

I recently upgraded our domain to Active Directory. I temporarily made the server that was to become the Exchange Server a domain controller. I implemented Exchange, then deployed a new server for the domain controller / intranet server.

I planned on demoting the Exchange server to a member server, however, is this absolutely necessary? How big of a security risk is it to have the Exchange server a domain controller? I'm affraid that demoting the Exchange server will have a negative effect on Exchange.

Suggestions?
Thanx
-Keith-

 

[brontosaurus]

it's not a problem, leave it alone. it's better to have a second DC for redundacy anyway.

 

[keithmyers]

I know it's good to have more than one DC. I am asking about the possible security risk of the Exchange server being a DC.

-Keith-

 

[brontosaurus]

if someone can make their way into your exchange box, chances are they can get to a DC as well. just keep up to date and practice good security measures.