Recently, I was tasked with modifying Mail Restrictions for every distribution group in our organization.

The requirements were to ensure that only Authenticated users were allowed to email internal distribution groups. In addition to this, there should be a Distribution Group for blocking internal users that abuse the distribution groups.

If you’ve ever tried to modify the properties of multiple distribution groups in AD, you find out pretty quickly that you can’t!!

Enter ADModify!!

Here are the steps that I took to meet the companies requirements:

PART 1 – Configure distribution groups to only accept messages from authenticated users

• Download ADModify.NET.zip from ftp://ftp.microsoft.com/PSS/Tools/Exchange%20Support%20Tools/ADModify
  
• Extract the zip file to a location on your hard drive
• Launch ADModify.exe
• Click on Modify Attributes
• In the Domain List pull-down menu, choose: DC=Domain, DC=.com
• In the Domain Controllers List, choose a DC in the closest proximity to your workstation
• Click the Green Right-Arrow
• Double-Click the Organization name, and navigate to the OU that has your Distribution Group.
• Once you have found the proper OU, ensure it’s highlighted, and click ‘Add To List’
• This will populate the right pane with all of the distribution groups within the selected OU.
• Highlight all of the Distribution Groups that you want to modify, and click ‘NEXT’
• This will bring up a window with a lot of tabs, and configuration settings. Click on the ‘Custom’ tab.
• Place a check next to ‘Make a customized attribute modification’
• To ensure only Authenticated Users can send messages to distribution groups, use the following settings:

Attribute Name = Authorig

Attribute Value =msExchRequireAuthtoSendTo

Click GO

PART 2 – Create a distribution group for blocking internal users

Now for the second requirement: We need the ability to block certain individuals who may try and abuse the Distribution Groups (i.e. disgruntled employee who is about to leave the company)

I created a mail-enabled distribution group called ‘Blocked DG’. We will populate this group as needed. You have to use a distribution group for this, even though you would THINK you would need a security group. And yes, it has to be mail-enabled.

Now, just follow the same steps that we used in part one, except the Attribute name and value will obviously be different.

Attribute Name = dLMemRejectPerms
Attribute Value = DN of distribution Group (e.g. CN=Blocked DG,OU=Hidden,OU=Distribution Lists, DC=domain,DC=com

Click GO!

Now to answer the inevitable:

• How do I know what attribute to use?
• How do I extract the DN for a given object?

For a list of exchange specific attributes, refer to:
http://technet.microsoft.com/en-us/library/aa997251.aspx

I have found that the easiest way to extract a DN is by using CSVDE. Simply drop to a command prompt, and type:

Csvde –F output.csv

This will extract all objects and attributes from AD in a .CSV file. Once the file is extracted, simply open the .CSV in excel, do a ‘Find’ for your object (e.g. Blocked DG), and you will find the corresponding DN.