I've just demoted a domain controller and although there are two other domain controllers available, one with all the FSMO roles and both Global Catalogs, I have 3 Event ID 9385 entries logged since demotion. However, ExBPA revealed no major problems (drivers out of date, for example). Mail flows in and out correctly. Blackberry intergration with Exchange works fine as well. Current domain controllers are both W2K3 SP2 (one is virtual - temporary as I plan to promote a new DC shortly). Exchange 2007 SP2 RU 10 Here is the error message: Microsoft Exchange System Attendant failed to read the membership of the universal security group '/dc=local/dc=MyDomain/ou=Microsoft Exchange Security Groups/cn=Exchange Servers'; the error code was '8007203a'. The problem might be that the Microsoft Exchange System Attendant does not have permission to read the membership of the group. Yes, I've checked to see that the Exchange Server (we only have one) is a member of the group. I have not changed permissions (would have never had the idea to do so) so I do not believe that is the problem. Any ideas? Thanks in advance!

Restart the System Attendant service.

That seems to do the trick. I'll watch it for a while yet , just to make sure