Forefront Security for Exchange Server SP1 Capacity Planning Tool


The new Forefront Security for Exchange Server SP1 capacity planning tool helps customers understand what hardware, architecture, and configuration settings will produce recommended system performance and message throughput results for comprehensive protection of their Exchange Servers. This tool, an excel spreadsheet with built in workflow, applies to the Forefront Security for Exchange Server SP1 product. The user will be able to plan the details for a new deployment or understand the impact of adding security protection to an existing deployment. In short, the user will choose their CPU and memory tolerances for deployment, their target reference architecture, their desired protection settings, and their targeted supported user load. Once this is defined, the tool will either recommend scaling up or out on the base recommended hardware for each server role.

For additional details, please read the “Directions” and “Readme” tabs. A “Resource” tab is also provided with links to obtain additional data to help make an informed decision during the planning stage.

This tool has a specific purpose and a limited scope. Please carefully read this entire page to understand the data output by this tool and how to use it properly.

Description: The Microsoft Forefront Security for Exchange Server (FSE) capacity planning tool acts as a complement to a Microsoft Exchange Server capacity plan to help you understand the additional computing power required to add Forefront Security for Exchange Server to an Exchange Server environment. Whether you are planning an Exchange deployment or you are adding Forefront Security for Exchange Server to your existing Exchange environment, you can use this tool to estimate the total hardware required to run Forefront Security for Exchange Server on your Microsoft Exchange Server infrastructure. Based on knowledge of your unique environment and requirements, you can use the information from this tool to help make decisions about scaling your infrastructure to maximize performance without over-allocating server hardware when you deploy Forefront Security for Exchange Server.

NOTE: This capacity planning tool is not a replacement for thorough Exchange capacity planning. It should not be used to create an Exchange capacity plan, nor should you base hardware purchase decisions exclusively on the information gleaned from this tool. Rather, this tool should be used to help further inform a detailed Exchange capacity plan.


The Capacity Planning Tool is designed to help you estimate your Microsoft Exchange capacity needs, and is intended to assist but not replace your complete Microsoft Exchange capacity planning. Network configurations vary, so you may need more software and/or hardware than that which the Capacity Planning Tool estimates in order to effectively deploy Microsoft Exchange Server and/or Microsoft Forefront Security for Exchange Server on your network.

You may use the Capacity Planning Tool only to estimate the Microsoft Exchange Server capacity needs for your network and not for any other purpose.

All organizations are unique, and they have requirements, policies, behaviors, and cultures that guide the specification of requirements and inform hardware purchase decisions. The output from this tool gives you an idea of the additional load created by Forefront Security for Exchange Server on sample server environments created for each of the reference architectures. You can use the data we collected from the sample environments to understand how Forefront Security for Exchange Server impacts utilization and performance, and that understanding can be combined with the Exchange capacity plan and your knowledge about the organization and its IT landscape to help guide decisions. Exchange capacity plan and your knowledge about the organization and its IT landscape to help guide decisions.

Background: It is not logistically feasible to test every possible combination of deployment scenario, application configuration, and user load profile. Therefore, Microsoft established a baseline for each reference architecture using FSE Service Pack 1 (SP1) and then identified a total of 80 different test scenarios to run the reference architectures, plus an additional 30 scenarios to run specifically against the edge. Details about baseline settings and hardware specifications are below. The data collected from the test environments enabled us to predict the additional computing resources consumed based on the various settings, message rates, and so forth.

FSE Settings: Forefront Security for Exchange Server (FSE) is highly configurable and has many settings. In this tool, you are using settings that have a practical impact on performance. There are a number of other settings that have minimal or no performance impact and are not included in the tool.

This tool refers to user load profiles, which characterize the e-mail usage patterns across an organization. The profiles correspond to specific data as follows:

User Load Profile

Send/Receive Messages per day

Database cache/user

Estimated IOPS/user

Logs Generated / mailbox


5 sent/20 received

2 MB




10 sent/40 received

3.5 MB




20 sent/80 received

5 MB



Very Heavy

30 sent/120 received

5 MB



Note these values, and then select the user load profile that corresponds most closely to the e-mail usage patterns in your organization.

Reference Architectures:  The results used to create this capacity planning tool were derived from two reference architectures for Forefront Security for Exchange Server: Standard and Enterprise.

Standard Reference Architecture (SRA): The SRA combines the hub and mailbox roles on a multi-role server. 

In our environment, the SRA was deployed with 1,600 users with an “average” user load profile.


Enterprise Reference Architecture (ERA): The ERA breaks out roles for the hub and mailbox servers.

In our environment, the ERA was deployed with two mailbox servers. Each mailbox server had 1,000 users with a “heavy” user load profile.


Recommended Hardware: In line with Microsoft Exchange Server 2007 hardware recommendations, we recommend that you use an enterprise-class server device with:

  • Processor – 4 cores
  • Memory – 4 GB RAM

Hardware recommendations output by the tool use this as the baseline.

Hardware Utilized:

In this study, servers were configured as follows:

  • Edge and hub servers – HP DL380G4, 2 Intel Xeon 3-GHz hyper-threaded processors, 4 GB RAM, connected to an HP Storage Area Network (SAN) via Fibre Channel
  • Multi-role server – HP DL380G4, 2 Intel Xeon 3-GHz hyper-threaded processors, 10 GB RAM, connected to a HP SAN via Fibre
  • Mailbox servers – HP DL380G4, 2 Intel Xeon 3-GHz hyper-threaded processors, 8 GB RAM, connected to a HP SAN via Fibre
  • Domain Controller (DC), clients – Hyper-V virtual machines running on a HP DL380G5 with 2 Intel Xeon 3-GHz quad-core processors and 14 GB RAM. Each virtual machine was allocated 100% of 1 processor core and 2 GB RAM.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.