Remove Write DACL inherit (group) from the root domain

Microsoft Exchange Best Practice Analyzer
Warning: Write DACL inherit (group) The Write DACL inherit (group) right for the Exchange Enterprise Servers group should be removed from the root domain.

Run below command in Exchange Management Shell.

Remove-ADPermission “dc=domain,dc=local” -user “domain\Exchange Enterprise Servers” -AccessRights WriteDACL -InheritedObjectType Group