:Active Directory Forest: Getting write DACl inherit group in exchange analyzer I have run this:Remove-adpermission "dc=xyz,dc=com" -user "xyz.com\ExchangeServers" -AccessRights WriteDACL -InheritedObjectType Group Am I supposed to put something specific in "dc-xyz,dc=com" specific to my domain, etc.? I also tried: Remove-ADPermission "dc=xyz,dc=com" -user "xyz.com\Exchange Enterprise Servers" -AccessRights WriteDACL -InheritedObjectType Group I am not sure what to put in these entries: 1. Click Start -> Run -> type adsiedit.msc 2. Expand Domain partition, find DC=XYZ,DC=com3. Right-click it, -> Properties -> Security tab -> Advanced. 4. Remove the object xyz\Exchange Servers with the related permission. What do look for above specific to me? Thank you David

Yes, replace the "dc=xyz,dc=com" with your specific AD domain labels.So if your AD domain is test.local then :Remove-adpermission "dc=test,dc=local" -user "test\ExchangeServers" -AccessRights WriteDACL -InheritedObjectType Group

I can use this command but the AD domain is the same as previous so I am afraid I going to delete the current AD domain associated with currently since they are the same domain from previous SBS 2003 server to current 2008 server. See below + Remove-adpermission <<<< "dc=t********,dc=local" -user "test\Exchange E nterprise Servers" -AccessRights WriteDACL -InheritedObjectType Group [PS] C:\Windows\System32>Remove-adpermission "dc=t********,dc=local" -user "t*********\Exchange Enterprise Servers" -AccessRights WriteDACL -InheritedO bjectType Group Confirm Are you sure you want to perform this action? Removing Active Directory permission "t*********d.local" for user "t***********\Exchange Enterprise Servers" with access rights "'WriteDacl'". [Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"):n [PS] C:\Windows\System32>

You wont delete AD, justa specifcpermission for the Exch Enterprise Group that was added when you ran domainprep. ExBpa flagged that, yes?

Hmm, I get the following: Confirm Are you sure you want to perform this action? Removing Active Directory permission "t*******.local" for user "t*******\Exchange Servers" with access rights "'WriteDacl'". [Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"):y Remove-ADPermission : Cannot remove ACE on object "DC=T*******,DC=local" for account "T*******\Exchange Servers" because it is not present. At line:1 char:20 + Remove-adpermission <<<< "dc=t*******,dc=local" -user "t*******\ Exchange Servers" -AccessRights WriteDACL -InheritedObjectType Group

Is ExBpa alerting on it? Ok, assuming you attempting toremove the permission in the correct domain scope, then don't worry about it.The permission wasnt applied if you installed 2007 SP1into a fresh domain.

This is what I get in ExBpa: Write DACL inherit (group) :Active Directory Forest The Write DACL inherit (group) right for the Exchange Enterprise Servers group should be removed from the root of the domain. I only have one domain. The SBS 2003 was of course the previous server holding rights with domain then setup 2008 server with same domain and just seized roles on it and unplugged SBS 2003 server; 2007 SP1 is installed. Is this an error to ignore in ExBpa?

Yes, it is ok to ignore. There is no absolute requirement to remove it, just recommended.

Thanks I will just ignore then, just makes you double check things and try to clear anything that comes up in ExBpa.

Note that you can also check and removethe specific permission for the Exchange Servers group via adsiedit.msc as you mentioned in your intial post. But, not absolutely a requirement. But I understand that its nice to see a clean ExBpa report! :

Also, what do you mean by: check and removethe specific permission for the Exchange Servers group via adsiedit.msc as you mentioned in your intial post.? I checked the permissions but there is like 16 entires that state: Allow Exchange Servers (T************\Exchange Servers). This is in the DC=xyz,DC= properties tab-security-advanced.

Correct. One of them should list the write permission for the Exchange Servers group. ( If not, then no biggie as mentioned before - you dont have to remove that permission)