My post of May 4 exploring the question whether the upcoming Exchange 2013 release should force companies to upgrade their Active Directory infrastructures to a modern version generated a considerable number of messages. As you might recall, the question was originally debated at a spirited Q&A session at TEC in San Diego where the folks who were present reached a consensus that it would be acceptable if Microsoft declared that Exchange 2013 required Active Directory to run at Windows 2008 functional level. This approach seemed to offer many benefits, such as freeing up Microsoft engineering resources to work on new features instead of having to test Exchange against a complex matrix of older Active Directory levels. It also appeared sensible to refresh Active Directory as part of the planning process for the deployment of a new version of Exchange.

Paul Robichaux weighed in on the debate by coming down on the side of those who think that Exchange cannot force an update. Paul said that he thought “Microsoft should be working on the lowest-friction migration path possible”. It’s hard to disagree with this sentiment. Paul also didn’t think that my point about testing held water because so much of this is automated today. I still think that it’s valid because people do real work to plan, execute, monitor, and fix tests. If not, tests go wrong or fail to detect conditions – and we have seen the effect of this in some of the roll-up updates Microsoft has released for Exchange 2010.

Lots of email was generated about different aspects of the debate. Quite a few described a situation pertaining in many companies where it appears that the folks who run Active Directory and those who are responsible for applications are disconnected when it comes to infrastructure updates. This seems like a throwback to the era when IT departments operated in silos and I was surprised to see how often correspondents reported that the Active Directory managers did their own thing and didn’t really understand what applications needed. A lot of people noted that their IT infrastructures supported so many applications that it was almost impossible to test what effect an Active Directory upgrade might have. That came as quite a scary thought because it’s an inevitable fact of technology that sooner or later Microsoft will force customers to upgrade Active Directory. What happens then?

For example, some reported infrastructures that contain components (for instance, Samba or Netfiler) that depend on old authentication mechanisms such as NT LAN Manager V1. This is a very old mechanism that has been subsequently revised and largely replaced by more secure authentication mechanisms such as Kerberos. Others told of firewalls that exist between client computers and domain controllers that might cause authentication to break because the RPC dynamic port range changes between Windows 2003 and Windows Server 2008.

One point repeated over and over was that Exchange works fine with Windows 2003 – if it doesn’t break anything why attempt to fix it in Exchange 2013? This point was reinforced by the salient fact that none of the improvements in Active Directory when operated at Windows 2008 functional level impact Exchange in any obvious way (finer-grained password policies, SYSVOL replication, retention of logon data, and so on) and no version of Exchange supports the most obvious recent enhancement (read-only domain controllers). Essentially Exchange treats Active Directory as a highly functional LDAP server that also happens to store a great deal of its configuration data. There’s no great difference between Windows 2003 and Windows 2008 when it comes to LDAP queries and updates. I think this is a fair point that prompts the question “what advantage could Exchange get from modern Active Directory versions”? Cue deafening silence…

Of course, one of the big reasons for upgrading is to maintain support. Windows 2003 extended support finishes in July 2015 while Windows 2008 reaches the end of its extended support in 2018. It’s true that you could keep on running Active Directory on Windows 2008 R2 servers using Windows 2003 functional level well into the next decade and so secure peace of mind that this essential piece of your infrastructure is maintained until then. The support imperative runs into difficulties because Microsoft has done a pretty good job of ensuring that Active Directory can run in old modes on new versions of the O/S.

Although the testing matrix for the Exchange development group would be simpler if they could eliminate support for older versions of Active Directory, the downside from their perspective is that forcing an upgrade might slow adaption of the new release. Customers tend to take their time before they get around to deploying a new version of Exchange. It can take anything from six months to two years before a company is happy that its infrastructure can support a new version, that users have the right clients, that the help desk is ready to support the deployment, and that the migration won’t impact the business. Throwing Active Directory upgrades into the mix would probably create a further delay for a myriad of reasons from internal politics to cost-benefit analyses to the actual work necessary to perform the upgrade. Slowing an Exchange upgrade might also slow the adaption of other products such as new versions of Outlook and the other Office applications.

In a nutshell, I think the discussion can be summarized as follows:

• There are technical advantages such as longer support in moving Active Directory to a recent version such as Windows 2008 functional level running on Windows 2008 R2 servers. However, there don’t seem to be many business advantages for such a move.
• There are definite performance advantages in running domain controllers and global catalogs on modern hardware. In other words, it’s time to dump those old 32-bit computers (if you still have any that are still limping along).
• Even applications like Exchange that make such extensive use of Active Directory cannot impose a requirement to upgrade Active Directory unless the engineering group creates a compelling case for such an upgrade.

So after all the argument and debate, the simple fact is that whereas there are a lot of “nice to have” benefits of running the latest and greatest Active Directory, Exchange 2010 runs fine with Active Directory operating in Windows 2003 functional level. Given the lack of evidence to prove that the newest version of Active Directory delivers anything that Exchange 2013 could exploit, I anticipate that the same forest functional level will continue for Exchange 2013. Time will tell.

Follow Tony @12Knocksinna