Gmail Address Book

[fiza]

@FN-GM to hide it from the Global Address book you need to go to Groups in the Admin Console.

 

 

 

 

Take the tick off 'list this group in the directory'.

 

That should do it.

[FN-GM]

Cheers, its just for a couple of groups such as our backup notification group

[FN-GM]

@fiza Did you use a tool to build up a regex?

 

I am looking for a way to block students sending to other DNS domains and to groups within their own DNS domain, but can't figure it out!

 

Thanks

[fiza]

@FN-GM It was a while ago now but I used this site to test. https://regex101.com/

[rogerdnixon]

@fiza Did you use a tool to build up a regex?

 

I am looking for a way to block students sending to other DNS domains and to groups within their own DNS domain, but can't figure it out!

 

Thanks

 

To block sending to other domains and only allow ones you list, use "Restricted Delivery" under Compliance in mail settings. You can then list domains you allow and block all others - this is what we use for our primary schools students.

 

To allow all - but block sending to specific domains, use a "Content compliance" rule in mail settings. So create a rule that blocks "any envelope recipient" that contains the domain you want to block. You can use a compliance rule to block pretty much anything you want e.g. emails containing the work "dog" if you wanted. We use this setting to prevent our secondary students from emailing primary accounts.

 

You can also use compliance rules to block students from emailing groups. However, I'd normally use group permissions to allow members of a group to post or not. So for example we have a group called "students" - students are members who can view but not post and Leadership Group are owners and can post. Group permissions are very granular.

[enjay]

You can also use compliance rules to block students from emailing groups. However, I'd normally use group permissions to allow members of a group to post or not. So for example we have a group called "students" - students are members who can view but not post and Leadership Group are owners and can post. Group permissions are very granular.

 

We had that set up at my last school, but here we use Salamander to create an email group for every class, and I'm not about to make that change on 700+ groups!

 

Re. your reference to primary schools, have you moved schools or joined an academy with your feeders?

[FN-GM]

Hello @rogerdnixon

 

Under compliance it lists sending and receiving from certain domains in the restrict delivery section, but I can't see sending only? Also I can't see how to stop emailing to groups?

 

Thanks

[rogerdnixon]

We had that set up at my last school, but here we use Salamander to create an email group for every class, and I'm not about to make that change on 700+ groups!

 

Re. your reference to primary schools, have you moved schools or joined an academy with your feeders?

 

Our primary schools we look after are sub-domains of our domain (Wheatley Park) .

 

You can edit group permissions in bulk using GAM - you just need a list of your groups in a csv file: https://github.com/jay0lee/GAM/wiki/GAM3GroupSettings

Edited May 4, 2017 by rogerdnixon

[rogerdnixon]

Hello @rogerdnixon

 

Under compliance it lists sending and receiving from certain domains in the restrict delivery section, but I can't see sending only? Also I can't see how to stop emailing to groups?

 

Thanks

 

Restricted Delivery applies to both sending and receiving - you list the domains to allow. Everything else is blocked.

 

You use Content Compliance rules to do anything fancier. So you can restrict delivery to a group there. So to block delivery to a group, use "Advanced Content Match", "Any envelope recipient", "Contains text", Content = group name.

 

Alternatively, don not allow group members to post - only owners - which is what we do for most student groups - they can view but not post. You change in the individual group settings or via GAM if you have lots.

[FN-GM]

Thanks for the reply

We want to allow to receive from any domain.

Do you have to specify the group name? We have thousands.

The GAM option will require changing a setting every time a group changes. This happens daily with classes changes etc so that will be a problem.

 

I am guessing routing based on expression is the way forward? All our groups are prefixed with DG so should be achievable.

[rogerdnixon]

You can block sending to all external domains with a content compliance for outbound mail only which contains the text "@" - ie all email addresses.

 

For class groups (we have about 600), we do it by group settings - so students are members who cannot post and teachers are owners who can. The groups are created this way - so when membership changes it does not matter as the group settings are static. We only use group settings not content compliance for control of groups. We have very few groups that anyone can post to - mainly public collaborative inboxes.

[FN-GM]

Not all domains are external though, the other schools in the trust are in the same G Suite tenant.

 

Using routing rules it should be possible. We will need

 

1. A route the block sending to anything but domain.com

2. Block all messages where the address begins with DG

 

I have tried this but G Suite moans about syntax errors

 

RegExComposer

[rogerdnixon]

If they are all on the same G Suite setup - i.e. all sub-domains under one primary domain - then they are classed as internal mail not external and won't be affected - unless you want them to be.

[FN-GM]

Exactly, that is my point, so that is why I would use mail routing options

[rogerdnixon]

Exactly, that is my point, so that is why I would use mail routing options

 

I'm probably being thick - but why? You can block outgoing mail for a specific sub-OU(s) with one content compliance rule without impacting on internal mail between your sub-domains at all. Just tried this with a test user in an test OU (its not something we do) - worked fine.

[FN-GM]

Because I want it to impact on internal mail as well. I don't want unrestricted access between sub-domains. Edited May 4, 2017 by FN-GM

[FN-GM]

Also to add to that the restriction won't stop them email groups.

[rogerdnixon]

Then just add an additional rule for those additional internal domains. So one rule to block emailing outside the global G Suite domain and another to block emailing to sub-domains you don't want specific users to email. We do this to prevent secondary students emailing primary ones on another of our sub-domains.

[FN-GM]

Right, think I have got it now!

 

But I have just realized I have stuffed up. Currently the kids can only send emails to staff and receive messages from anywhere. But I think I can recreate this with a compliance rule as well. All our kids email addresses being with a year EG: 2016, In the recipient header options I could just do the attached?

 

Sorry about the confusion, my head is spinning now!

 

Cheers

Edited May 4, 2017 by FN-GM

[FN-GM]

@rogerdnixon sorry for being an idiot before, couldn't see the wood for the trees!

 

Can you use wildcards for the expressions in the compliance rules?

 

Also I have set a rule that works, but the user doesn't get a bounce message. Is this correct please?

 

thanks

[rogerdnixon]

I'm not sure about wildcards as such - but you can match any string or part string that appears in a specific part of the message or anywhere - see: https://support.google.com/a/answer/1346934?hl=en

 

When you setup a content compliance rule there is an option at the bottom for an message if you are rejecting the message.

[FN-GM]

Thanks,

 

I think the bounce messages are not getting there because of a mail routing issues. I think the bounce is being sent to Office 365.

 

Cheers

[DavidYoung]

Hi,

 

We found half a solution to the directory problem. We are leaving the company directory disabled but giving staff a CSV file to import into their contact lists in Google. We are generating this list from AD with the following Powershell script:

## Script to query AD and export the results in a CSV compatible with Google Contacts.

$searchBase = "OU=UsersOUs,DC=domain,DC=TLD"
$includeCompanies = @("School1","School2")
$includeDepartments = @("Staff")
$CSVpath = ".\Google-Contacts.CSV"

try{$ADusers = Get-ADUser -SearchBase $searchBase -filter {enabled -eq $true} -Properties department,company,mail,name,givenName,sn,displayname,title,msExchHideFromAddressLists}
catch{throw "Error getting users from AD: $_.Exception.GetType().FullName, $_.Exception.Message"}

$ADusers = $ADusers | Where-Object {($_.department -In $includeDepartments) -and ($_.company -In $includeCompanies) -and !($_.msExchHideFromAddressLists)}

$CSV = @()

foreach($user in $ADusers){
   $formattedCompany = $user.Company -replace("^([0-9]{7} )","")
   $row = @{'Name'=$user.displayname;
           'Given Name'=$user.givenName;
           'Family Name'=$user.sn;
           'E-mail1-Value'=$user.mail;
           'Email1-Type'='Work';
           'Organization1-Name'=$formattedCompany;
           'Organization1-Title'=$user.department;
           'Organization1-Job Description'=$user.title;
           'Group Membership'=$formattedCompany
   }
   $CSV += New-Object PSObject -property $row
}

try{$CSV | Export-Csv -Path $CSVpath -NoTypeInformation -Force -ErrorAction Stop}
catch{throw "Error creating file $CSVpath : $_.Exception.GetType().FullName, $_.Exception.Message"}

Write-host "CSV Created: $CSVpath"

Edited May 10, 2017 by DavidYoung
Remove school details from script

[enjay]

We found half a solution to the directory problem. We are leaving the company directory disabled but giving staff a CSV file to import into their contact lists in Google.

 

What's the plan for updating that as staff and students join or leave?

[DavidYoung]

What's the plan for updating that as staff and students join or leave?

 

I said it was half a solution!

 

Seriously though, we can keep a centralised CSV which staff can import as many times as needed and then merge the contacts to remove duplicates. Removing leavers would have to be done manually by the staff.

 

It's not my favourite solution but seems to be the best we can do now.