Which rights are required by exchange administrators in an AD domain? Do they require domain admin access? Or is it best practice to give the account only the rights it needs? thanks stu

Depends on what rights you are referring to. Exchange Org Mgmt does not require domain admin membership to manage the Exchange org however.

Possible reason given are To email address attributes in AD To check invisibility in Global Address book To Check target address To check Lync attributes in AD To Check duplication of email address and in general for troubleshooting LYNC and AD issues related to Exchange.