When I runing domainprep on my new server I got message: “The domain “test.local” has been identified as an insecure domain for mail-enabled groups with hidden DL membership. Hidden DL membership will be exposed to members of the built-in “Pre-Windows 2000 Compatible Access” security group. This group may have been populated during the promotion of the domain with the intent of allowing permissions to be compatible with pre-Windows 2000 servers and application. To secure the domain, remove any unnecessary members from this group.”

To resolve this I run: “Active Directory Users and Computers” and go to: “Builtin” groups, Right click “Pre-Windows 2000 Compatible Access Group” and select properties. Click on the “Members” tab and removed the authenticated users