OK, here is how Mozilla/Thunderbird LDAP works with Exchange 2000-2003:

1. The default LDAP port for Active Directory is 3268 (not 389) so make sure you've got this port open thru the firewall, and make sure to configure it in your LDAP account settings in Mozilla/Thunderbird.

2. For Base DN, you MUST enter something like dc=yourdomain,dc=com (whereas Outlook Express lets you get away with putting NULL).

3. For Bind DN, you must enter a domain user which has permission to search the directory. You should enter it qualified by the NetBIOS domain name, for example: mydomain\username

4. For some reason, Thunderbird doesn't always seem to recognize that it needs to log on before querying. The easiest, most reliable way I have found to force it is to go to the Offline tab in the Directory Server Properties and click the Download button. This function seems to "see" that Active Directory wants a logon, so Thunderbird will display the logon dialog to let you enter your domain credentials. For the username, specify exactly the same thing you put into Bind DN.

5. Results are returned asynchronously to the Thunderbird Address Book, so you might see "No matches found" immediately after clicking the Search button. Wait a few seconds, and your results should show up.

6. Mozilla and Thunderbird default to a Search Filter of (objectclass=*) which will return lots of useless (non-email address) entries from Active Directory. You can override this with something like (objectclass=person) on the Advanced tab of Directory Service Properties. Depending on what kinds of addresses are in your Active Directory, you may need to refine this filter more (for example, if you've got mail-enabled Public Folders which you want to display).

7. The Address Book UI in Thunderbird is just clumsy. You CANNOT search an LDAP directory by simply selecting it on the left hand side and then entering your search in the "Name or Email contains" textbox. You MUST click the Advanced button to define an LDAP search. After you find your desired address(es) in LDAP, you "should" be able to copy it to your local addresses but the stupid UI only lets you look at the Properties or add it to the recipient list for a new message (by clicking the Write button).