How to Install/Configure Windows 2003 Pop3 Service

NOTE: This was edited from http://www.ilopia.com/Articles/WindowsServer2003/EmailServer.aspx and from that site, it has pretty pictures as well!

You can install the Email Server by using Add or Remove Windows Components or Manage Your Server. Manage Your Server is a bit easier to use too, because it will prompt you for the domain you want to use during setup. That will not Add or Remove Windows Components do, and we have to do everything manually.
If it’s not open, start Manage Your Server by clicking Start->Programs->Administrative Tools->Manage Your Server.

* Click on Add or remove a role.

This will start the Configure Your Server Wizard. Read the text and make sure you have connected all the necessary cables and all the other things it says you should do before continuing.

* Click Next

The wizard will now detect your network settings. This will take a while depending on how many network connections you have

We now come to the step where we add and remove roles for our server. We will add the Mail Server role. I also suggest that before you click Next,

* Click Mail server (POP3, SMTP)
* Click Next

You will now specify the type of authentication and type the email domain name.

* Click Next

Next step is to confirm the options you have selected.

* Click Next

The installation will start, and will also start the Windows Components Wizard. When you get prompted to insert your Windows Server 2003 CD-ROM into your CD-ROM drive, do so. If you didn’t get prompted to do that, you maybe already have it in the drive.

* Click Finish

Install the Email Server

* Click Start, then run, and type p3server.msc

This will open up the POP3 Service. This is where you configure and manage the POP3 part of the mail server.

* Click on <ComputerName> in the left pane
* Click on Server Properties in the right pane

This brings up the Properties for our Mail Server.

Authentication Method

There are three different authentication methods you can use; Local Windows Accounts, Active Directory Integrated and Encrypted Password File. It is an important decision which method to use, because once you have chosen, you must delete all email domains on the server to change method (from now on, you can migrate Encrypted File user accounts to AD, but nothing else can be migrated).

* Local Windows Accounts
If your server is stand alone (not member of an Active Directory domain), and you want to have the user accounts on the same local computer as the POP3 service, this is the best option. By using this option, you will use the SAM (Security Accounts Manager) for both the email user accounts, and the user accounts on the local computer. This means that a user can use the same user name and password to be authenticated for both the POP3 service and Windows on the local computer. But there is a limitation, although you can host multiple domains on the server, there must be unique user names for all domains. So, let us say you have two users named Sandra. One working at company1.com and another one working at company2.com. Their user name used will be sandra@company1.com and sandra@company2.com. But in SAM, they will both have the same user name, sandra, so one of them must be renamed to something else (if we don’t want them to read each other’s emails).

If you create the user account when you create the mail box (by using the POP3 interface), the user will be added to the POP3 user group. Members of this group are not allowed to logon locally. The fact that the users are added to the POP3 group does not mean that you must be a member of this group to have a mailbox. You should however be careful adding mailboxes to users that are not member of the POP3 group, because the password used for email can for example be sniffed (if you are not using SPA), or someone can brute force the password and gain access to the server.
* Active Directory Integrated
You can select this option if the server is a member of an Active Directory domain or is a Domain Controller. By using this you will integrate the POP3 Service with you AD domain. AD users can use their user name and password to send and receive email. Of course you have to create mailboxes to them first. Unlike Local Windows Accounts you can use the same user name on different domains. So sandra@company1.com and sandra@company2.com will have different mailboxes. There is however one thing you should know about, that does not affect the mailbox name and email-name, and the pre-Windows 2000 user name can be changed. Active Directory do not support the same pre-Windows 2000 user name, and this name is usually the same as the user name, which means that if you create a mailbox and user with the same pre-Windows 2000 user name, it will rename the pre-Windows 2000 user name.
* Encrypted Password File
This is the option you want to select if you don’t use Active Directory or don’t want to create users on the local computer. Like Active Directory Integrated you can have the same user name on different domains, but you cannot assign the same user name to several mailboxes within the same domain.
This method works by creating an encrypted file stored in each user’s mailbox. This file contains the password for the user. When the user wants to check his/her email, the password that the user supplies is encrypted and compared to the one in the file.
It is possible to migrate Encrypted File user accounts to AD user accounts.

Logging Level

Four options to choose between. If you change this, remember that you must restart the POP3 service.

* None
Nothing is logged.
* Low
Only critical events are logged.
* Medium
Both critical and warning events are logged.
* High
Critical, warning and informational events are logged.

Root Mail Directory

If you don’t want to use the default Mail Directory, you can choose another one. Make sure the path is not more than 260 characters and you can also not store to the root of a partition (i.e. C:). It is strongly recommended that you use a NTFS formatted partition. You can’t use a mapped drive, but the UNC name (\\servername\share) can be used. If you later change the store, and there are still emails in one or more boxes, you must manually move the folders in which there are emails to the new location. You must also reset the permissions on the directory by using winpop set mailroot.

SPA

Enable SPA if you want to have a secure communication between your email sever and email clients. This will send both the user name and password encrypted from the client to the server, instead of sending it in clear text. SPA supports only Local Windows Accounts and Active Directory Integrated Authentication. It is recommended to use this. Remember to restart the POP3 service if you change this.

Create a mailbox

The Setup Wizard created a domain to us, so we do not need to create this manually. If you did not use Manage Your Server to install, add the domain manually be clicking the server name in the left pane and then click New domain in the right pane. Remember to set the properties before you add the domain.

* Click on your domain (ilopia.com in my case) in the left pane.
* Click Add Mailbox in the right pane.

This will open up the Add Mailbox window.

* Write bob in Mailbox Name
* Write bob as password (of course this is not a password you should use in a production environment, it’s too short)
* Click OK

A message will pop-up and tell you how to configure the email clients. Read this, and notice the difference when using SPA or not.

* Click OK

What we just did was not only creating a mailbox named bob, but we also created a user bob. We will also create a mailbox for an existing user – ariel. To do that we simply perform the same steps, but we uncheck Create associated user for this mailbox. Remember that the mailbox name must be less then 21 characters (64 for Encrypted Password File and Active Directory). Periods are allowed to use, but not as the first or last character.

So, we have now two users. Are they equally? No, bob is a member of the POP3 Users group, which is denied to logon locally. Ariel is not member of this group, and can still logon locally and access her mailbox.