Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Active Directory offers a feature called Service Connection Points to publish information to applications so they can discover the relevant server; however the documentation is sparse and I have trouble understanding

  • Where the information is stored (Configuration partition?)
  • What information is shared?
  • How is it secured?
  • What applications use it (Outlook Autodiscover does, perhaps SCOM too?)

This is especially interesting for situations where we have LDAP sync going or a DSML endpoint exposed.

Any additional information on SCP is appreciated

share|improve this question
up vote 1 down vote accepted

SCPs should be put in the Domain partition, under the host that provides the service, so that it is correctly replicated.

The SCP contains whatever information the service wants it to. Typically it has some identifiers for the service (so the client can find it) and then connection details for the service (like an IP and port number). But the service can put anything it wants in there, and can even extend the schema if need be - Microsoft don't know what some random service might need, so they kept it general. See

It's secured exactly like any other Active Directory client lookup.

Lots and lots of applications use it: it's the way you do service discovery in AD. Certainly all the Microsoft apps will use it, so yes, Exchange and SCOM do. And so do lots of 3rd party vendors.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.