Assuming you can read VBScript, here's a link to a script from Microsoft showing how to find the location of a mailbox for a user account.
The script is querying the "homeMDB" attribute of the user (to get the DN of the the mailbox database holding the user's mailbox). Then, they're querying that MDB to find the DN of the server object that "owns" the MDB, using the value of the the "msExchOwningServer" attribute of the MDB (BTW, you can ignore the bits about the storage group, because you don't care about that).
Assuming you want a DNS name, query the "networkAddress" property of the server object (the one named in the "msExchOwningServer" attribute of the MDB object returned by querying the DN of the user's "homeMDB"), and take the value starting with "nacn_ip_tcp". That'll give you the FQDN of the server hosting that MDB.
Edit:
I didn't mean to imply that you needed to execute the VBScript-- just that it would tell you what to query with ldapsearch. Likewise, when I said "server object", I didn't mean to imply that you would be instantiating some kind of VBScript object-- only that you would query the DN named for the server.
So, assuming I want the DNS name of the server hosting the mailbox for user Bob, I'd query with the LDAP search filter "(sAMAccountName=Bob)" at the root of the domain (or root of the global catalog, if I wanted to search all domains in the forest) for Bob's "homeMDB" attribute.
ldapsearch -h ad.example.com -D bind-user@ad.example.com -W -b "DC=ad,DC=example,DC=com" -s sub -x "(sAMAccountName=Bob)" homeMDB
This returns the homeMDB attribute:
homeMDB: CN=Mailbox Store (EXCH-SRV),CN=First Storage Group,CN=InformationStore,CN=EXCH-SRV,CN=Servers,CN=EXAMPLE,CN=Administrative Groups,CN=Example Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ad,DC=example,DC=com
Then, using that homeMDB attribute as a base DN, query for "msExchOwningServer":
ldapsearch -h ad.example.com -D bind-user@ad.example.com -W -b "CN=Mailbox Store (EXCH-SRV),CN=First Storage Group,CN=InformationStore,CN=EXCH-SRV,CN=Servers,CN=EXAMPLE,CN=Administrative Groups,CN=Example Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ad,DC=example,DC=com" msExchOwningServer
This returns the DN of the server hosting that mailbox database:
msExchOwningServer: CN=EXCH-SRV,CN=Servers,CN=EXAMPLE,CN=Administrative Groups,CN=Example Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ad,DC=example,DC=com
Finally, using the server's DN as the base DN, query for the "networkAddress" attribute:
ldapsearch -h ad.example.com -D bind-user@ad.example.com -W -b "CN=EXCH-SRV,CN=Servers,CN=EXAMPLE,CN=Administrative Groups,CN=Example Organization,CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ad,DC=example,DC=com" networkAddress
This returns all the network addresses, of which you're interested in the one starting with "nacn_ip_tcp".
networkAddress: ncacn_vns_spp:EXCH-SRV
networkAddress: netbios:EXCH-SRV
networkAddress: ncacn_np:EXCH-SRV
networkAddress: ncacn_spx:EXCH-SRV
networkAddress: ncacn_ip_tcp:EXCH-SRV.ad.example.com
networkAddress: ncalrpc:EXCH-SRV
You can do the same thing for the "homeMTA" attribute, but you'll search for "msExchResponsibleMTAServerBL" instead of "msExchOwningServer" when querying the DN named in the "homeMTA" attribute.
Finally, if you want to forego all of that, query the user for the "msExchHomeServerName" attribute.
msExchHomeServerName: /o=Example Organization/ou=EXAMPLE/cn=Configuration/cn=Servers/cn=EXCH-SRV
Take the value returned there and use that as the serach filter on the "legacyExchangeDN" attribute and search the Exchange-related subtree of the directory for the "networkAddress" attribute.
ldapsearch -h ad.example.com -D bind-user@ad.example.com -W -b "CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=ad,dc=example,dc=com" -x "(legacyExchangeDN=/o=Example Organization/ou=EXAMPLE/cn=Configuration/cn=Servers/cn=EXCH-SRV)" networkAddress
And you'll get back the same network addresses as above.
Best Answer
You can't use LDAP to create an Exchange Mailbox. The main reason is that the user will get an Exchange Mailbox GUI ID which can only be generated by the Exchange Subsystem (e.g. via PowerShell).
You can't fake that one and add some random fields via LDAP.
However there are some possible options for you: