What information is exposed in AD's Service Connection Points (SCP)

Question

Active Directory offers a feature called Service Connection Points to publish information to applications so they can discover the relevant server; however the documentation is sparse and I have trouble understanding

• Where the information is stored (Configuration partition?)
• What information is shared?
• How is it secured?
• What applications use it (Outlook Autodiscover does, perhaps SCOM too?)

This is especially interesting for situations where we have LDAP sync going or a DSML endpoint exposed.

Any additional information on SCP is appreciated

Answer 1

SCPs should be put in the Domain partition, under the host that provides the service, so that it is correctly replicated.

The SCP contains whatever information the service wants it to. Typically it has some identifiers for the service (so the client can find it) and then connection details for the service (like an IP and port number). But the service can put anything it wants in there, and can even extend the schema if need be - Microsoft don't know what some random service might need, so they kept it general. See http://msdn.microsoft.com/en-us/library/windows/desktop/ms677947%28v=vs.85%29.aspx

It's secured exactly like any other Active Directory client lookup.

Lots and lots of applications use it: it's the way you do service discovery in AD. Certainly all the Microsoft apps will use it, so yes, Exchange and SCOM do. And so do lots of 3rd party vendors.