The following discussion seems to state that SP1 install removed the Write DACL.
http://social.technet.microsoft.com/Forums/en-US/exchangesvrdeploy/thread/122c2b78-0d39-489f-b72a-e3b1ff5d6857
"
Hi,
if we are having Exchange 2007 SP1, there is no need to run cmmdlt below:
Remove-ADPermission "dc=<Domain>" -user "<RootDomain>\Exchange Servers"
-AccessRightsWriteDACL -InheritedObjectType Group
Because the Write DACL inherit (group) right for the Exchange Servers group has not
been added to the root of the domain when doing the /domainprep.
Let
me explain more. Before Exchange 2007 SP1, running PrepareDomain
currently grants all Exchange servers the "Modify Permissions" right at
the root of the domain.
It
is changed in Exchange 2007 SP1. If we have prepared Active Directory
for Exchange 2007 with Exchange 2007 Service Pack 1 install media, the
Write DACL inherit (group) right for the Exchange Servers group has not
been added to the root of the domain. In this situation, we do not need
to perform this command.
Besides, we can check permission on XYZ from ADSIedit.msc
1. Click Start -> Run -> type “adsiedit.msc”
2. Expand Domain partition, find DC=XYZ,DC=com
3. Right-click it, -> Properties -> Security tab -> Advanced.
4. Remove the object “xyz\Exchange Servers” with the related permission.
Regards,
Xiu"
Verification needed