Lessons Learned Report

**Title:** Exchange Services Failure to Start After Reboot – GPO Link Order Misconfiguration

ENCLAVE – AR2.1 Exchange Deployment Environment

By Jessie Rice

1. Description of the Issue

During troubleshooting of AR2.1 Exchange services, it was discovered that the services failed to start automatically (and in some cases manually) after a system reboot. The issue persisted until specific Group Policy Object (GPO) configurations were corrected.

2. Root Cause

The problem was traced to incorrect GPO link ordering in Group Policy Management:

– The ‘Default Domain Policy’ and ‘Default Domain Controllers Policy’ GPOs were mistakenly set last in the link order.

– These policies were intended to have highest precedence (i.e., first in the link order) at the domain root and in the Domain Controllers OU, respectively.

– As a result, other GPOs—namely:

  – ‘User Pol 4 Exchange 5-22’

  – ‘AR21 – Windows Server 2016 V2R1 – DC – Computer’

  – ‘Domain User Pol Adds 04-22’

overwrote critical security settings in the ‘Default Domain Controllers Policy’.

3. Technical Details

The failure specifically affected the ‘Manage auditing and security log’ user right (SeSecurityPrivilege), located in:

Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment

– This right must include the ‘SHIP\Exchange Servers’ group to allow Exchange services to start.

– This assignment is automatically configured during Exchange installation via the ‘Default Domain Controllers Policy’.

– When this GPO is overridden by others lacking the necessary permission, Exchange services on servers like MB-002 will fail to start, as they consult the DC (e.g., DC-003) for effective policy settings during boot.

4. Resolution

– GPO link order was corrected:

  – ‘Default Domain Policy’ set to first in the domain root.

  – ‘Default Domain Controllers Policy’ set to first in the Domain Controllers OU.

– RSOP (Resultant Set of Policy) was run on DC-003, confirming correct policy inheritance and proper permissions.

– Post-correction, Exchange services started successfully upon reboot.

5. Impact

– Delayed startup and availability of Exchange services on the AR2.1 system.

– Required manual troubleshooting efforts during a critical system deployment phase.

– Risk of repeat failure in other domains if GPO link order is similarly misconfigured.

6. Lessons Learned

– GPO link order matters: Lower-priority GPOs can be unintentionally overridden by higher-link-order GPOs, even if they contain essential system configurations.

– Default policies must remain prioritized: Policies like ‘Default Domain Controllers Policy’ contain foundational security settings and must not be moved down in the GPO hierarchy.

– Use RSOP and GPResult proactively: These tools should be used during system validation to verify effective permissions, especially after GPO restructuring.

– Exchange installation modifies GPOs: Be aware that Exchange setup changes domain controller policies—post-install validation is recommended.

7. Recommendations

– Audit all domain GPO link orders to ensure proper precedence of default policies.

– Document and standardize GPO hierarchy for all deployments.

– Include GPO validation checks as part of the Exchange deployment and server hardening checklist.

– Train sysadmins and field techs on the significance of GPO link ordering and tools like RSOP.