It used to be recommended that the Domain servers house no other functionality.
The CEO and outside IT firms keep bringing up that they would like to use these servers for additional functions - like FTP/Mail/etc.
Has security improved to make such a scenario ok? I'm not surprised by the CEO's suggestion, but I'm surprised that external IT firms would suggest such a thing. Am I that behind the times?
Compromise of the Domain servers seems so serious that I keep these machines completely locked down.
EDIT - THANKS FOR RESPONSES
It sounds like things haven't changed and nothing should be installed on DCs. I'm really puzzled by the external IT organization suggestions. They were all suggesting that this was ok.