Exchange Trusted Subsystem has Reanimate-Tombstones extended right — is this expected?

Hi everyone,

I’m reviewing an Active Directory environment where Exchange Trusted Subsystem appears to have the Reanimate-Tombstones extended right.

I understand that this permission allows a principal to reanimate deleted/tombstoned AD objects, so I’m trying to understand whether this permission is expected for Exchange.

• Is it normal for Exchange Trusted Subsystem to have this permission?
• Is it required for any Exchange functionality?
• If it is not required, is removing the permission considered safe?
• Are there any Exchange operations or features that could break if this permission is removed?
• Has anyone encountered this permission on Exchange environments before?

I’m mainly looking for guidance on whether this is legitimate Exchange delegation or an unnecessary permission that should be removed.