# Active Directory Root Permissions

We currently have way too many users in our Domain Admins group so I'm working on redesigning our active directory structure and I'm looking at the current permissions and looking at the root our our domain (domain.local) in the Active Directory Users and Computers snap-in I see an extremely large number of users/groups with different levels of access. What I'm confused about is that there are over 60 entries (multiple for the same group) that show nothing in the Access column and they are exclusively Exchange related groups. The same groups do have entries with values in the Access column

I'm just wondering if anyone knows why those would be there?

• Could be audit entries or property-level permissions. Could you provide a screen shot (with obfuscated/blurred principal names)? Maybe also version and functional level details about AD/DC's and Exchange – Mathias R. Jessen Sep 18 '14 at 17:52
• I initially had a screenshot in but I cannot post screenshots as my reputation score is too low. Some of the principal names are Exchange Trusted Subsystem, Exchange Recipient Administrators, Organization Management, and more. AD is running at a 2003 functional level and Exchange is 2010 (migrated from 2007) SP1. – Martin Sep 18 '14 at 19:31
• Those are applied by the Exchange Schema Prep tool. They make a real mess of things. You can also use the DSACLS cli tool to get another look at them, still not great, only slightly better. – Clayton Sep 19 '14 at 19:26