Can't Run Add-ADPermission to DLs (Created in e12 or e2k3)

Hi All,

I got problem when trying to grant manager permission on the DLs (Created on 2k3 and 2k7 before) via 2010 EMS.

Add-ADPermission -Identity 'DL' -User 'Manager' -AccessRights WriteProperty -Properties 'Member'

Error: Active Directory operation failed on DC. This error is not retriable. Additional information:Access is denied.

The issue is similar to the ones in the threads below:

http://social.technet.microsoft.com/Forums/en-US/exchangesvrgeneral/thread/0960b944-82b2-42f1-b438-a7d57b7ab783

http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/ff0f78c8-4518-4c3d-b67d-e1da10923bc9

The permission can only be granted when ownership of DL belongs to exchange server, and looks like a bug.

Someone mentioned to add “Exchange Servers” group into the security setting of OU that contains DLs. Does anyone know what exact permissions need to be granted for "Exchange Servers" group.

Any other suggestions would be very appreciated! Or any update on this bug from MS side.

Thanks!!