Hi All, I'm in the design phase and I've read numerous articles regarding the permissions model and forests and domains and still cannot decide which to choose. Any help will be appreciated. Current Exchange Server: Exchange 2003 in a separate forest/domain on its own. New Exchange Server: Exchange 2007 SP1 in a child domain of principle forest. Requirements: The forest root (France) is not required to perform any administrative functions once the organization is setup. My local domain (Dallas) has complete authority over Exchange admin functions, routing, etc. Other than my local domain (Dallas), other domains are not affected by implementing Exchange 2007. Every continent is a spearate business entity and autonomous, except for AD, which performs basic DNS and subnetting only. e.g. The North America Exchange Server consists of Dallas and 2 otherdomains in Canada plus the standalone forest/domain for the current Exchange server. The Exchange 2007 server is a member of the prinicple forest AD structure so DPM 2007 can contact it and perform backup functions (requirement of DPM). Every domain in the forest has its own Exchange server, which will stay that way. They are all Exchange 2000 or later and this would be the first Exchange 2007 server. It is unclear in the articales that I've read exactly what controls and functions are restricted to Exchange Organizational Admins, which is my primary concern if it resides in the forest root. To meet these requirements, is it best to install within the forest. Clarity on best topology for this scenario greatly appreciated. Chris

You said each domain has its own Exchange server today. Are these currently in seperate Routing Groups? Bear in mind that Exchange 2007 does away with Routing Groups and all Exchange 2007 servers in a forest/org use the same "Exchange 2007" Routing Group. AD Sites are the new way mail is routed by default.Read this link for discussions about how to map the routing needs to the new design:http://msexchangeteam.com/archive/2006/11/01/430185.aspx While I think the above will be your most complex task, your question was actually regarding the permissions?This article describes each group and what it can and cannot do:http://technet.microsoft.com/en-us/library/aa996881.aspxThe above two links will likely answer most of your design questions, but if you could be more specific I'd love to discuss further detail with you.