Microsoft has been using the Security Development Lifecycle (SDL) across its product lines for several years now, and we've seen an across-the-board improvement in product security as a result. As a security practitioner, this situation makes me happy indeed, but as an Exchange Server administrator, I want functional improvements to the product as well. Given that Microsoft is already actively working on the next version of Exchange, I wanted to set down a few things I'd like to see in the Exchange Server of the future.
Keep in mind that for every feature we get, there are other features that don't make the cut. Even with the company's massive resources behind them, Microsoft's developers have constraints that prevent them from adding every desired feature while still meeting their schedules and deadlines. That said, here are a few items from my wish list for the next Exchange release (in no particular order).
Let's start with a relatively easy one: The next version of Exchange should include full support for Outlook Web Access' premium mode in Firefox and Safari. Multiple-browser support is an important checkbox for the education market (where you're likely to find more people using non–Microsoft Internet Explorer browsers), but it's also something that I would expect to see from the company that pioneered the commercial use of Asynchronous JavaScript and XML (Ajax) in Web applications—not to mention that Microsoft Office Communicator Web Access and all of IBM's Lotus products already fully support these browsers.
How about certificates? Microsoft Office Communications Server (OCS) 2007 has a Certificate Wizard that helps you get the right set of machine names and subject alternative names in your certificate requests. Now that the OCS and Exchange product lines are part of the same business unit within Microsoft, perhaps the two teams could collaborate to produce a single certificate tool that collects all the necessary parameters for certificate requests? Network security and Exchange administrators everywhere would greatly appreciate and benefit from such a feature.
I've heard many requests for running Exchange services on Windows Server Core, the barebones install option with Windows Server 2008; the obstacle here is that the current version of Windows PowerShell won't run on Server Core. The Windows or PowerShell teams might address this problem on their own; personally, I'd rather they spent their engineering efforts on giving us complete support for running Exchange under Hyper-V.
A streamlined Exchange version for small businesses that are nonetheless too big for Small Business Server seemed like a nice idea until Microsoft announced its plans to offer online hosted versions of Exchange, SharePoint, and OCS. Perhaps the effort that would otherwise have gone toward that initiative can be channeled into a feature such as a better interface for message tracking or a more useful set of event log entries for determining when one user has logged on to another user's mailbox—both of which, by the way, would certainly be welcome features, judging by the number of times I've seen people ask for them!
One major problem with software, of course, is that not everyone uses every feature. A feature that's critically important to Alice might be utterly uninteresting to Bob, and vice versa. To help lend some weight to the discussion, I've asked several Exchange MVPs to chime in with their favorite feature requests; I'll present their wish lists next week