This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(268.8, 39%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPS%3C/text%3E%3C/svg%3E)
I currently have Exchange 2016 CU23 running on Windows 2016 Server. One of my colleagues deleted a few of the built-in Exchange security groups that were created during the installation of Exchange. Some of these groups are needed for RBAC permissions, as well as viewing receive connectors within the ECP. They have been deleted for over a year now and we don't have any backups to restore them. What's the easiest way to recreate/restore them?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(137.6, 20%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMH%3C/text%3E%3C/svg%3E)
It's been a while since the last update. Do you need more help from me? If so, please feel free to contact me.
In addition, if the following answer is helpful to you, you can mark it as an answer, which will help the community. Thank you for your understanding!
Hi,
Welcome to the Microsoft Q&A forum!
Based on my experience, there are two ways to deal with this situation.
The first method is creating new role group in EA. You can customize the permissions you need for the new group. For details you can refer to part Work with role groups of this article：Exchange Server permissions
The second way is to use the Setup.exe command with the /PrepareAD switch to recreate the default security groups. This command will reinitialize the default RBAC roles and groups. Here is the command you can run:
Setup.exe /PrepareAD /IAcceptExchangeServerLicenseTerms
More information about prepare AD:Prepare Active Directory and domains for Exchange Server
Hi Mike -
Thank you for the prompt response. I will try your suggestions next week during my maintenance window and give you an update on whether it's successful. I'm leaning more towards the latter suggestions, by running the PrepareAD. Thanks again.
PS