How Exchange Server 2007 CAS Proxying works for Outlook Web Access (OWA)

This might be a bit off topic, but we just brought our first exchange 2007 server online. We host Exchange and use Postini as our main smtp gateway so to start simple we are bringing 3 exchange 2007 servers with NLB online that have both the cas and hub

transport role (edge will come later). Anyway, after installing the first cas / hub transport server I was unable to hit my exchange 2003 mailbox using the

https://exchange2007server/exchange URL (received 404 page could not be found errors). I searched high and low for an answer and the only thing close was this article:

http://support.microsoft.com/kb/932438

but this is only when you have e2k7 cas + mailbox on one server trying to hit an e2k3 mailbox server. I saw one obscure post and did some digging to find out that our new exchange 2007 server was NOT added to the Exchange Domain Servers security group by default...

why not? I manually added it into the group, waited a little for replication and then bam it started to work fine. Oh yeah, the installation also RESET our perms for domain admins at the Exchange organization level (I know, heaven's me, domain admins with

"send as"...) and we had to manually remove the deny perms -- BES and Goodlink choked for while too.