I am searching for the best practice of securely deploying windows domain controller and exchange in a small-medium size network (50+ users, 20+ virtual servers). The topology is single firewall staying between wan and internal router (l3 switch) and firewall has a dmz leg. We have users, servers etc. vlans. How would you deploy them ?