Share via

is it safe to remove Exchange Trusted Subsystem group from Administrators group?

Abdul-Malik 20 Reputation points
2023-02-05T20:59:47.3466667+00:00

Hi all,

We have Exchange server 2019 and we found it is member of AD built in Administrators group.

Is it safe to remove Exchange Trusted Subsystem group from AD Administrators group?

Best regards,

Abdu;-Malik

Exchange | Exchange Server | Other
Exchange | Exchange Server | Other

A robust email, calendaring, and collaboration platform developed by Microsoft, designed for enterprise-level communication and data management.Miscellaneous topics that do not fit into specific categories.

Exchange | Exchange Server | Management
Exchange | Exchange Server | Management

The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.

Exchange | Other
Exchange | Other

A powerful email and collaboration platform developed by Microsoft, designed to support enterprise-level communication and productivity. Miscellaneous topics that do not fit into specific categories.

{count} votes

Answer accepted by question author
  1. Andy David - MVP 159.9K Reputation points MVP Volunteer Moderator
    2023-02-05T21:36:36.2666667+00:00

    Hi there, do NOT remove it from that built-in AD group, modify or delete that group!

    Its essential to Exchange.

    https://learn.microsoft.com/en-us/exchange/permissions/split-permissions/split-permissions?view=exchserver-2019

    User's image


1 additional answer

Sort by: Most helpful
  1. Me&Me 0 Reputation points
    2026-03-05T14:09:19.1533333+00:00

    The Exchange Trusted Subsystem should NOT be a member of the Builtin\Administrators group in AD.

    It isn't there in my environment and I've ran /prepareAD already to confirm it doesn't get added back.

    You're giving a system with lots of access, even more access and removing the guardrails that were there in the process.

    I can't find if it was default some time in the past, but: https://adsecurity.org/?p=4119 should put some emphasis on removing it!

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.