r/exchangeserver • u/Chemical-Wall9026 • 5d ago

Exchange Trusted Subsystem has Reanimate-Tombstones extended right — is this expected?

Hi everyone,

I’m reviewing an Active Directory environment where Exchange Trusted Subsystem appears to have the Reanimate-Tombstones extended right.

I understand that this permission allows a principal to reanimate deleted/tombstoned AD objects, so I’m trying to understand whether this permission is expected for Exchange.

  • Is it normal for Exchange Trusted Subsystem to have this permission?
  • Is it required for any Exchange functionality?
  • If it is not required, is removing the permission considered safe?
  • Are there any Exchange operations or features that could break if this permission is removed?
  • Has anyone encountered this permission on Exchange environments before?

I’m mainly looking for guidance on whether this is legitimate Exchange delegation or an unnecessary permission that should be removed.

0 Upvotes

50% Upvoted

2 comments sorted by

2

u/Beneficial_Stay_8998 5d ago

Yes, it is required for restoring mailboxes. Check out the AD split-permission model if intrusive permissions for Exchange Trusted Subsystem are a concern.

1

u/7amitsingh7 1d ago

Yes, this can be a legitimate permission in an Exchange environment. Exchange Trusted Subsystem has several delegated permissions in AD, and Reanimate-Tombstones may be present depending on the Exchange version and setup.

I wouldn’t remove it without first confirming that it was granted by Exchange and checking whether any Exchange functionality depends on it. If it was manually added, then it’s worth investigating before removing it.