The Write DACL inherit (group) right for the Exchange Enterprise Servers group should be removed from the root of your Active ...