Our environment consists of a top-level root domain as a placeholder domain and our production domain underneath. We just ran setup /prepare schema and /prepareAD last night. I noticed that new Microsoft Exchange Security Groups OU and security groups were added to the top-level domain and not the domain in which Exchange is currently installed. Given that the domains are trusting each other, will this present any complications? I was expecting the new security group OU to be added to our production domain. Docs I've found indicate this new OU should be created in the forest root domain which would mean we are OK. The new Exchange 2007 administrative group was added successfully in the ESM. Please advise.