Core Exchange Server 2003 Services


The following figure illustrates the core components of Exchange Server 2003, together with their service dependencies. Core components are System Attendant, the Exchange Information Store service, the IIS Admin service, the SMTP service, and the Exchange installable file system (ExIFS). All of these services must be running on every Exchange Server 2003 server to guarantee a fully functioning messaging system.

Core Windows services and their dependent core Exchange Server 2003 services


IIS Admin service and SMTP service are integrated with IIS, as discussed in the previous section. The SMTP service must run on every server running Exchange Server 2003 because all messages sent to or from local recipients must pass through the SMTP transport engine. If the SMTP service is stopped or unavailable, Exchange Server 2003 cannot deliver messages. For more information about the routing architecture of Exchange Server 2003, see Message Routing Architecture.

The core components of Exchange Server 2003 have the following responsibilities.

  • Microsoft Exchange System Attendant service   System Attendant is one of the most important services in Exchange Server 2003. This component has many responsibilities, including maintaining communication with Active Directory, generating offline address lists, performing message tracking, and so forth. The executable file is Mad.exe and is located in the \Program Files\Exchsrvr\Bin directory. There are several registry keys that System Attendant uses for its various internal components under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\, such MSExchangeSA, MSExchangeDSAccess, MSExchangeAL, MSExchangeFBPublish, MSExchangeMU, and MSExchangeADDXA.

    The following table lists the responsibilities of System Attendant.

    Internal System Attendant components and their responsibilities

    Component Responsibility Comments

    DSAccess Component

    Locating domain controllers in the network and providing other Exchange services with Active Directory information

    System Attendant must find domain controllers and global catalogs in the network, so that the Exchange services can access recipient and configuration information. To find domain controllers, System Attendant uses ADSI to do a server-less binding.

    To proxy directory access from other Exchange components, such as Exchange store and SMTP transport engine, to Active Directory, System Attendant includes a DSAccess component (DSAccess.dll). DSAccess also caches directory information to reduce the number of queries to Active Directory. For more information about roles of domain controllers and global catalogs, and DSAccess, see Exchange Server 2003 and Active Directory.

    DSProxy Component

    Proxying legacy MAPI clients to Active Directory

    System Attendant's DSProxy component (Dsproxy.dll) refers Outlook 2000 and later versions to a global catalog server so that the MAPI client can communicate with Active Directory to get access to the global address list. DSProxy also relays directory communication for older MAPI clients that cannot be referred directly. For more information about DSProxy see Exchange Server 2003 and Active Directory.

    Free/Busy Component

    Maintaining free/busy information for Outlook Web Access users

    System Attendant is involved when publishing free/busy information in Outlook Web Access. When a user creates an appointment, the Exchange store extracts the free/busy information from the user's calendar and sends the data in a message to the System Attendant mailbox. The free/busy component (Madfb.dll) processes these messages and publishes the free/busy information in the SCHEDULE+ FREE BUSY system public folder. For more information about publishing free/busy information, see Exchange Information Store Service Architecture.

    Mailbox Manager Component

    Managing mailboxes

    The mailbox manager component enforces message retention policies and mailbox quotas that you can use to manage mailbox store sizes.

    Metabase update service

    Replicating settings from Active Directory to the IIS metabase

    The Directory Service to metabase update service (Ds2mb.dll) is an internal component of System Attendant. The Metbase Update Service replicates protocol settings from Active Directory to the IIS metabase to apply Internet protocol settings that you configure in Exchange System Manager to the Internet protocol engines, such as the SMTP service. For more information about the metabase update service, see Exchange Server 2003 and Active Directory.

    Offline Address Book Generator

    Generating offline address books

    The offline address book generator (Oabgen.dll) creates address lists in the Exchange store on an offline address list server. Users can then connect to this server and download the offline address lists. Offline address lists provide access to address information when a user is working remotely and does not have a permanent connection to the server. Because offline address lists are stored in a hidden public folder, it is possible to replicate the offline address lists to multiple servers.

    Recipient Update Service

    Applying recipient policies and generating proxy addresses

    The Recipient Update Service (Abv_dg.dll) is the System Attendant component that monitors all mail-enabled user objects and recipient policies, and applies recipient policies to mail-enabled user objects. For more information about the Recipient Update Service, see Exchange Server 2003 and Active Directory.

    Server Monitor Component

    Monitoring server resources

    System Attendant monitors server resources at periodic intervals and updates link state information (LSI) through Windows Management Instrumentation (WMI). System Attendant also updates the routing table so that the routing engine can make informed routing decisions based on the current status of servers and connectors. For more information about link state information, see Message Routing Architecture.

    System Attendant is also responsible for maintaining the message tracking logs if message tracking has been enabled on a server.

    System Attendant Component

    Verifies computer account configuration

    The computer account of an Exchange server must be a member of a global security group called Exchange Domain Servers to grant Exchange Server 2003 the required access permissions to Active Directory. System Attendant verifies, in the background, that the computer account belongs to this group.

  • Exchange Information Store service   The Microsoft Exchange Information Store service is another very important component in Exchange Server 2003, because it maintains the messaging databases that contain all server-based mailboxes and public folders. The executable file of the Exchange Information Store service is Store.exe, located in the \Program Files\Exchsrvr\Bin directory. The corresponding registry key is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS.

    The Exchange store uses Extensible Storage Engine (ESE) to maintain the messaging databases and supports a variety of clients through corresponding store extensions. The following figure illustrates how the various client types can access messaging data.

    Exchange store architecture and supported messaging clients


    MAPI clients communicate directly with the Exchange Information Store service through MAPI RPCs. Internet clients, however, use protocol engines integrated with IIS, as explained earlier in this section. Internet clients and Web applications communicate with the Exchange store through IIS protocol engines. This communication takes place through a store driver, Epoxy.dll, and store extensions, such as ExSMTP.dll or ExIMAP.dll. The EPOXY layer is a fast inter-process communication (IPC) mechanism based on shared memory, which is used by Drviis.dll and store extensions to coordinate their processing. For example, when delivering an inbound message through SMTP, Drviis.dll uses the Exchange installable file system to create a message item in the Exchange store, and then communicates with ExSMTP.dll through EPOXY to instruct the Exchange store to further process the message (that is, to place the message into the recipient's mailbox). For more information about the interaction between Drviis.dll, Epoxy.dll, store extensions, Store.exe and ExIFS, see Exchange Information Store Service Architecture.

  • Exchange Installable File System   The Exchange installable file system is a kernel-mode driver, implemented in ExIfs.sys, which IIS protocol engines and Web applications can use to read and write items from and to messaging databases. To gain access to the databases, the ExIFS file system driver must communicate with the Exchange store. This is accomplished through a store extension (ExWin32.Dll) and a user-mode wrapper (Ifsproxy.dll). The Exchange store, on the other hand, uses ESE to access .stm and .edb files, which are files that reside on a drive formatted with the NTFS file system. The following figure illustrates this architecture.

    The ExIFS architecture


    As mentioned in Exchange Server 2003 Technical Overview, a mailbox store or public folder store is made up of a streaming database (.stm) and a MAPI database (.edb). The IIS components use ExIFS to work with streaming databases, while MAPI clients, such as Outlook, work with MAPI-based databases (.edb). A streaming database holds Internet messages in their native format, such as MIME, while an .edb database stores e-mail messages in MAPI format. The Exchange store must keep both the streaming databases and the corresponding MAPI-based databases synchronized. To accomplish this, the Exchange store must communicate with ExIFS, in addition to ESE. For example, when allocating free space in a database, ExIFS requests space from ESE. ESE must track which pages in the streaming database are reserved and committed. Thus, the Exchange Information Store service depends on ExIFS. The registry key for ExIFS is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EXIFS. For more information about ExIFS and the architecture of the Exchange store, see Exchange Information Store Service Architecture.


    ExIFS is the only kernel-mode component in Exchange Server 2003.