Running URLScan on Exchange 2003

Do we need to run URLScan on our Exchange Server 2003 systems?

No, not if you're running Exchange 2003 on Windows Server 2003. URLScan is intended for use on Windows 2000 machines running Microsoft Internet Information Services (IIS) 5.0. IIS 6.0, which ships with Windows 2003, already includes all the URLScan functionality. You can't install URLScan on a new IIS 6.0 installation, but if you previously installed URLScan on a Win2K server and you upgrade the server, URLScan will continue to function—it's just not necessary. Whenever possible, you should run Exchange 2003 on Windows 2003 to get the best possible security and scalability.

—Paul Robichaux