Exchange is So Sensitive
After demoting a Domain Controller you get an error every 5 minutes on your Exchange Server that says, “SACL Watcher servicelet found that the SeSecurityPrivilege privilege is removed from account SID.”
Restart the Microsoft Exchange Active Directory Topology service (MSExchangeADTopology). Keep in mind this will also restart several other services that are disruptive to users so try to do this after hours.
As a side note to find which object the SID belongs to run LDP.exe & use the SID Lookup tool.