I have the following problem. Recently we have migrated from Notes/Domino to Exchange 2010. We had some problems with the first installation. In case of that we decided to reinstall Exchange.

Stupid was that we deleted some Exchange objects from the AD withe the Active Directory Users and Computers management tool. Thereby a simple reinstallation was not possible. After deleting all Exchange entries by ADSI, the server could then be installed without problems again and is working fine at the moment. ;-)

The actual problem is that all security permissions on all AD objects have obsolete SID's (even newly created objects). These SIDs are without a doubt the Exchange objects (OrganizationManagement, Exchange Server, Exchange Trusted Subsystem, Windows Exchange permissions) of the old installation.

Image: http://imageshack.us/photo/my-images/842/unbenanntuyh.png/

Is there a way to remove these permissions on all objects? I know about the tool SubInACL...

Thanks in advance



In scheme "CN=Organizational-Unit,CN=Schema,CN=Configuration,DC=xxx,DC=xxx" there is the following string under the attribute "defaultSecurityDescriptor":


Could it be that a part of the value is the reason for this?


These entries are likely inherited from the top of your AD. Using Active Directory USer and Computers, open up properties on your top level domain and remove the old entries from the security tab there. That should clean up the all the objects.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.