How to set up SMTP replication on Windows Server 2008-based domain controllers

Setting up a certification authority

To enable SMTP replication, you must have a certification authority. You can select a domain controller to host this role. To install a certification authority on a domain controller, follow these steps:

1. Click Start, point to Administrative Tools, and then click Server Manager.

2. In the console tree, click Roles, click Add Roles in the details pane, and then click Next.

3. Click to select the Active Directory Certificate Services check box, and then click Next two times.

4. Verify that the Certification Authority check box is selected, and then click Next.

5. Click Enterprise, and then click Next.
   
   Note This setting lets you set up an enterprise certification authority that can work with automatic certificate enrollment.

6. If this is the first certification authority that you have created, click RootCA, and then click Next. If this is not the first certification authority that you have created, click Subordinate CA, and then click Next.

7. Click Create a new private key, and then click Next.

8. You can specify the settings that you want for the new key. Or, you can keep the default settings. Then, click Next.

9. Specify a name for the certification authority, and then click Next.

10. Specify a validity period for the certification authority certificate, and then click Next.

11. Specify the certificate database location and the log location, and then click Next.

12. Confirm the settings, and then click Install.

Configuring the membership of the Certificate Service DCOM Access group

To make sure that computers from all domains that are involved in the replication process receive certificates, you must include the following groups as members of the Certificate Service DCOM Access group on the certification authority:

• Domain Users

• Domain Controllers

• Domain Computers

The membership must include these groups for each domain that has computers that will replicate over SMTP connections. For example, assume that you have a domain A.com and a child domain B.A.com. Additionally, assume that you want computers from both domains to replicate over SMTP connections. In this situation, you must include the following groups as members of the Certificate Service DCOM Access group:

• CN=Domain Users,CN=Users,DC=A,DC=com;

• CN=Domain Controllers,CN=Users,DC=A,DC=com;

• CN=Domain Computers,CN=Users,DC=A,DC=com;

• CN=Domain Users,CN=Users,DC=B,DC=A,DC=com;

• CN=Domain Controllers,CN=Users,DC=B,DC=A,DC=com;

• CN=Domain Computers,CN=Users,DC=B,DC=A,DC=com;

To add members to the Certificate Service DCOM Access group, follow these steps:

1. Open the Active Directory Users and Computers snap-in.

2. In the console tree, expand Active Directory Users and Computers, expand the node that corresponds to your domain, and then click Builtin.

3. In the details pane, right-click Certificate Service DCOM Access, and then click Properties.

4. On the Members tab, add the required members to the Members list, and then click OK.

Enrolling the certificates for SMTP replication

Installing the SMTP Server feature

Install the SMTP Server feature on all domain controllers that will replicate over SMTP connections. To do this, follow these steps:

1. Open the Server Manager snap-in.

2. In the console tree, click Roles, click Add Roles in the details pane, and then click Next.

3. Click to select the Web Server (IIS) check box, select all components except the FTP Server component, and then click Next.

4. In the Server Manager snap-in, click Features in the console tree, and then click Add Features in the details pane.

5. Click to select the SMTP Server check box, and then click Next.

6. Click Install.

Installing the Intersite Messaging (ISM) service for SMTP transport

To install the Intersite Messaging service for SMTP transport on all Windows Server 2008 domain controllers that will replicate over SMTP connections, follow these steps:

1. Open an elevated command prompt, and then run the following command:

   %windir%\system32\pkgmgr /iu:DirectoryServices-ISM-Smtp

2. Wait until the Ismsmtp.dll file is present in the following folder:

   %windir%\system32

3. Restart the Intersite Messaging service by running the following command at a command prompt:
   

   net stop ismserv && net start ismserv

Configuring SMTP site links

Now you can configure SMTP site links in the Active Directory Site and Services snap-in. To do this, follow these steps:

1. Click Start, click Run, type dssite.msc, and then click OK.

2. In the console tree, expand Sites, expand Inter-Site Transports, right-click SMTP, and then click New Site Link.

3. Specify a name for the new site link, add the sites that you want to the Sites in this site link list, and then click OK.

The domain controllers will start replicating after the new topology is propagated to all the domain controllers. For more information about site link settings, see the Windows Server 2008 Help documentation.