Exchange Domain Servers Inheritance Block

I asked a question about how to solve the Permissions inheritance block on Exchange Domain Servers Group Object

Access control list (ACL) inheritance is blocked for the Exchange Domain Servers group object in domain '' (CN=Exchange Domain Servers,CN=Users,DC=laxeypartners,DC=com). This may cause mail flow problems, recipient update service failures and other service outages. Use the Active Directory Users and Computers program to re-enable inheritance on this object.

....a while ago and I got an answer which confirmed what I had to do, basically tick the box so the Group inherited from it's parent.

I did that and the Exchange 2010 BPA stopped complaining, however on running it again a few hours later, it's back to complaining about it until I re tick the inheritance box.

So my question now is, why does it keep reverting back to the unticked state?

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

did you add your exchange server member of any AD protected groups ?

i.e. is your exchange server member of domain admins, administrators, enterprise admins etc...
edwaltersAuthor Commented:
Not sure about what that meant, however I have checked who is a member of the Exchange Domain Servers group and it is only the current Exchange Servers int he organisation.

We have 1 2008 DC and two 2003 DC.  I've tried applying the Inheritance change tot he 2008 DC and the 2003 DC first, but either way the permissions revert after about 1 hour.
Find the exchange server computer account in Active Directory users and computers, and check in its properties the "Member OF" tab

can you share a screenshot

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
edwaltersAuthor Commented:
I think the problem was (as you suggest) the Exchange Domain Servers was a member of Domain Admins.  I've removed it from there and the permissions seem to be holding now.  i'll check again on Monday and award the points and close the call.


yea exactly if it is member of any AD protected groups inheritance will be removed periodically

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.