Linux Mail Server Setup and Howto Guide

About me:  I'm a long-time Linux user, but mainly an embedded micro developer.  I've occasionally done Apache servers as front-ends to embedded systems, but mostly I only "admin" PCs, so I don't know a great deal about "IT"-type server administration.

A "Windoze-only" friend works for a smallish business (about 150 users) that wants to move their mail service from godaddy to an in-house system.  They're using Windows Server 2003 and Active Directory to handle authentication and other "domain" functions,  but would like to avoid the cost of doing email on a new Exchange server.  So he asked his "Linux pal" to help set up a system for evaluating FOSS alternatives.

What we're looking at is a dedicated Linux box with Postfix and Dovecot (and probably Squirrelmail for web access), and "virtual" users authenticated through the existing Active Directory system.  To facilitate backups and archiving,  the mail storage will be on a dedicated RAID array,  mounted at /var/mailstore (so as not to interfere with local mail being stored at /var/mail).

My biggest question is whether the horror stories I've read about compatibility with MS email clients (mostly Outlook) are still true (many of the blog entries and forum postings have datestamps from years ago).  Is this a sane thig for a non-expert to attempt at all?

The other big question is how to authenticate with AD.  There appear to be two options:  using PAM with Kerberos on Dovecot (with Postfix talking to Dovecot through SASL),  or having both authenticate separately through LDAP.  I haven't found anything that indicates which is "better" in terms of compatibility or performance.

Another possibility (I think: am I reading the docs right?) would be to run OpenLDAP or 389 on the Linux box,  let it suck usernames and passwords from the AD server (which is already configured to be part of a "forest" of servers at the company's multiple locations),  and authenticate against the local copy.  That would reduce risk of incompatibility surprises,  since only one component would be interfacing with Microsoft,  and (one hopes) improve performance by reducing the number of transactions across the network.  Before I spend too much time looking into this:  is it feasible to create a limited "local caching" server like this?  Or will AD freak out if a "sapling" appears in the forest?

Thanks,

Ran