The Write DACL inherit (group) right for the Exchange Enterprise Servers group should be removed from the root of the domain. ...