The Manage Auditing and Security Log right (SeSecurityPrivilege) may have been removed for the Exchange Enterprise Servers domain local group on some or all of the domain controllers.