Restriciting the ability to send to Distribution Lists

[MrMuppet]

Wasn't really sure where to put this as it's technically an issue with Office 365 but all the work is being done on the server. Anyway, I've been scratching my head over this issue for about 5 hours now and I'm getting no where, it shouldn't be this difficult to stop people sending to a specific distribution list.

 

Basically we want to prevent all staff (apart from SLT) from e-mailing the "All College Staff" distribution list. I've read a load of articles on the net about restricting access through the admin section of Office 365's OWA but none of this applies to us as we use DirSync. The only article I've found which relates to my situation is this:

 

[sOLVED]Email restrictions for distribution group | Manage Office 365 | Microsoft Office 365 Community

 

I've followed this article, and the one Ulrik linked to, to use LDP on the domain controller to edit the dLMemRejectPerms and dLMemSubmitPerms but staff are still able to e-mail the "All College Staff" distribution list.

 

What I've done:

 

In ADUC (on the domain controller) on the security tab of the "All College Staff" distribution group, removed 'Send To' permissions for authenticated users (even tried denying this permission) yet staff can still send to this list. Also tried adding the "All Staff" security group (different to the "All College Staff" distribution group) and denying 'Send To' permissions. Reverted these changes after it didn't work. -Tried all this before I found the article about using LDP.

 

Used LDP to set '..SubmitPerms' to the "Senior Leaders" group (entering the 'DistinguishedName' as the value). Tried sending an e-mail from a normal staff account to All Staff, e-mail went through.

 

Set '..RejectPerms' to the "All College Staff" group, e-mail still goes through from a normal staff account.

 

After each change I waited for DirSync to do it's thing and then tried sending the e-mail.

 

If someone could point me in the right direction it would be much appreciated.

 

P.S.

To clarify, we are using Office 365 with DirSync to pull all our users and groups from AD. We have no on-site Exchange server.

Edited August 6, 2014 by MrMuppet

[jonawd]

You should be able to do this directly through the web page.. (Under Delivery Management on the Group itself in Exchange Admin Center)

 

That said, the method your using should work too.

Have you added the Exchange Schema to AD to do this or was it already in-place? (Previously had Exchange on-site)

 

Have you confirmed that the value is getting pushed in DirSync?

I'm pretty sure that dlMemSubmitPerms is one of the default values thats synced, but its worth checking that its actually updating the value has gone up.

FIM (miisclient) should be able to tell you whether the change is actually getting made.

[jonawd]

The way I usually do this is by updating the attribute (dlMemSubmitPerms) in the attribute editor. I dont think the Security tab will do what you need (but i've never tried that)

[synaesthesia]

We're setting this up at the moment but trying to change those attributes says we don't have an editor in place? (Didn't have exchanged installed but did follow steps to upgrade the schema only)

[jonawd]

We're setting this up at the moment but trying to change those attributes says we don't have an editor in place? (Didn't have exchanged installed but did follow steps to upgrade the schema only)

 

Unfortunately they are not standard fields, and cannot be edited in ADUC / ADSI unless you have exchange on-site.

You can use LDP.exe but thats very fiddly if your not used to it.

 

I think it's possible to do it through powerShell, although I've never tried it (and currently have nothing to test this on)

Something like this should do it:

 

set-adobject "CN=GroupIWantToRestric,OU=Groups,OU=School,DC=Domain,DC=local" -Add @{dLMemSubmitPerms="CN=myGroup,OU=Groups,OU=School,DC=Domain,DC=local"}

[synaesthesia]

Typical, another half-assed effort from MS then! I assume that beta replacement for the azure AD link thing won't help.

[MrMuppet]

Thanks for the quick response jonawd.

 

Part of the problem is that all the settings for the group are greyed out in the Exchange Admin Center because it was setup through DirSync.

 

I believe the Exchange Schema is already in AD as we used to have an on-site Exchange server but this was decommissioned after it crashed and we moved to Office 365, but I will double check.

 

Checked DirSync as well and the values for ..RejectPerms and ..SubmitPerms are getting pushed through. I'll investigate that FIM client and we'll see if that can shed some light on the situation.

 

*Edit* Checked the properties of the management agents and the attributes dLMemRejectPerms and dLMemSubmitPerms are both selected.

Edited August 6, 2014 by MrMuppet

[MrMuppet]

Synaesthesia - Haven't tried the beta AD link, might be worth a shot. As for LDP, it's not too difficult to use if you've got clear instructions but as jonawd said it is very fiddly.

 

If you want to use LDP I would suggest following the instructions here (LDP.exe should be located on your server under C:\Windows\System32):

 

Using LDP.exe to view your Active Directory

 

to get LDP connected to your domain controller then follow these instructions to actually set the values:

 

https://msonlinehelpdesk.zendesk.com/hc/en-us/articles/200561467-How-do-I-restrict-permissions-to-send-to-a-Distribution-List-in-an-AD-synchronized-Exchange-Online-environment-

[MrMuppet]

After a few more hours of tinkering I finally got this sorted.

 

It's a little strange as all the articles I've read say the 'unauthOrig' field is for blocking single users whereas the 'dLMemRejectPerms' is for blocking whole groups, but this was not the case for me. I just added the 'All Staff' SG to the 'unauthOrig' field and hey presto users receive a NDR when trying to e-mail the all staff DL.

 

So if anyone is in a similar situation to me, try the 'unauthOrig' field.