Exchange 2016 CU23: Some Built-in Exchange Security groups have been deleted. How do I restore them?

Question

Exchange 2016 CU23: Some Built-in Exchange Security groups have been deleted. How do I restore them?

Paul Siso 276

I currently have Exchange 2016 CU23 running on Windows 2016 Server. One of my colleagues deleted a few of the built-in Exchange security groups that were created during the installation of Exchange. Some of these groups are needed for RBAC permissions, as well as viewing receive connectors within the ECP. They have been deleted for over a year now and we don't have any backups to restore them. What's the easiest way to recreate/restore them?

Mike Hu-MSFT 4,085 Reputation points Microsoft External Staff

2024-09-12T09:50:07.3133333+00:00

It's been a while since the last update. Do you need more help from me? If so, please feel free to contact me.

In addition, if the following answer is helpful to you, you can mark it as an answer, which will help the community. Thank you for your understanding!

1 answer

Your answer

Mike Hu-MSFT 4,085 Reputation points Microsoft External Staff

2024-09-12T09:50:07.3133333+00:00

It's been a while since the last update. Do you need more help from me? If so, please feel free to contact me.

In addition, if the following answer is helpful to you, you can mark it as an answer, which will help the community. Thank you for your understanding!

Answer 1

Mike Hu-MSFT 4,085 Microsoft External Staff

Hi,

Welcome to the Microsoft Q&A forum!

Based on my experience, there are two ways to deal with this situation.

The first method is creating new role group in EA. You can customize the permissions you need for the new group. For details you can refer to part Work with role groups of this article：Exchange Server permissions

The second way is to use the Setup.exe command with the /PrepareAD switch to recreate the default security groups. This command will reinitialize the default RBAC roles and groups. Here is the command you can run:

Setup.exe /PrepareAD /IAcceptExchangeServerLicenseTerms

More information about prepare AD:Prepare Active Directory and domains for Exchange Server

Paul Siso 276 Reputation points

2024-09-13T03:26:53.86+00:00

Hi Mike -

Thank you for the prompt response. I will try your suggestions next week during my maintenance window and give you an update on whether it's successful. I'm leaning more towards the latter suggestions, by running the PrepareAD. Thanks again.

PS
Paul Siso 276 Reputation points

2026-10-02T00:30:27.2366667+00:00

Hi Mike -

So we ran /PrepareAD and encountered an error below:

[10/01/2026 23:21:34.0852] [1] [ERROR] The well-known object entry B:32:DB72C41D49580A4DB304FE6981E56297:CN=Recipient Management\0ADEL:9fabb83d-1ed9-45f9-9bc8-a979cfe17a36,CN=Deleted Objects,DC=hoplite,DC=local on the otherWellKnownObjects attribute in the container object CN=Microsoft Exchange,CN=Services,CN=Configuration,DC=domain,DC=com points to an invalid DN or a deleted object. Remove the entry, and then rerun the task.