Sign in with Microsoft
Sign in or create an account.
Select a different account.
You have multiple accounts
Choose the account you want to sign in with.
We're sorry. This article is not available in your language.


When you install Microsoft Exchange Server 2016 in an on-premises environment, the following groups are added to the Default Domain Controller policy:

  • Exchange Servers (EXS)

  • Exchange Trusted Subsystem (ETS)

However, this addition is incorrect. These groups should not be granted the SeDebugPrivilege permission.

The Debug programs policy path is as follows:

Default Domain Controllers Policy > Computer Configuration > Policies > Windows settings > Security Settings\Local Policies > User Rights Assignment > Debug Programs


Exchange Server 2016

Starting in Cumulative Update 9 for Exchange Server 2016, the SeDebugPrivilege permission is no longer granted during installation to servers that run Exchange Server or to Exchange Trusted Subsystem groups.

To remove the SeDebugPrivilege permission from these groups on domain controllers, follow these steps:

  1. In Group Policy Management Editor, go to the User Rights Assignment path.

  2. In the Debug programs policy, open the Debug program properties list, and then remove the Exchange Servers and Exchange Trusted Subsystem groups from the list.

  3. Click OK.


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.


Learn about the terminology that Microsoft uses to describe software updates.

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.

Was this information helpful?

What affected your experience?
By pressing submit, your feedback will be used to improve Microsoft products and services. Your IT admin will be able to collect this data. Privacy Statement.

Thank you for your feedback!