I had the privilege of setting up a new exchange server on our network and ran into a failure. During the Hub Transport installation the setup failed because the service wouldn’t start. Apparently during the Active directory prep, a new group is created called Exchange Servers. This group is given Manage Auditing and Security permissions on the Domain Controllers. In our environment we have that setting specified in the Default Domain controllers policy to only allow the Auditors group. As soon as that policy was refreshed it overwrote what the Exchange setup had done. It took a while but I finally tracked this down with the help of two other blog postings.