This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 51%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAM%3C/text%3E%3C/svg%3E)
Hi all,
We have Exchange server 2019 and we found it is member of AD built in Administrators group.
Is it safe to remove Exchange Trusted Subsystem group from AD Administrators group?
Best regards,
Abdu;-Malik
A robust email, calendaring, and collaboration platform developed by Microsoft, designed for enterprise-level communication and data management.Miscellaneous topics that do not fit into specific categories.
The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.
A powerful email and collaboration platform developed by Microsoft, designed to support enterprise-level communication and productivity. Miscellaneous topics that do not fit into specific categories.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(9.6, 31%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJX%3C/text%3E%3C/svg%3E)
Hi @Abdul-Malik ,
Just checking in to see if above information was helpful. Please let us know if you would like further assistance.
If the question has been answered, please accept the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well.
Hi there, do NOT remove it from that built-in AD group, modify or delete that group!
Its essential to Exchange.
It is seems. that Exchange admins choose domain controller as witness server , and DC has no local administrator group, so they added Exchange Trusted Subsystem group to built-in AD Administrators group.
So, we changed the witness server directory to be in file server and remove the above group from built-in AD administrator group and added them to local administrator group of file server.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(313.6, 15%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMM%3C/text%3E%3C/svg%3E)
The Exchange Trusted Subsystem should NOT be a member of the Builtin\Administrators group in AD.
It isn't there in my environment and I've ran /prepareAD already to confirm it doesn't get added back.
You're giving a system with lots of access, even more access and removing the guardrails that were there in the process.
I can't find if it was default some time in the past, but: https://adsecurity.org/?p=4119 should put some emphasis on removing it!