GAFE/GSFE: Stop users being able to email distribution lists

[Garacesh]

Each of our Active Directory departmental groups are synced to G Suite via GCDS at the moment, and each group gets its own email address. (i.e. 'Subject-Test' AD group becomes Test@domain)

Membership is controlled by AD/GCDS but permissions have been set on the groups manually. Everything is set to 'All members of the group' or higher (manager/owner) but my test pupil can still go into GMail and email Test@domain and the email goes through successfully. I want to block this, but I can't find a way of doing it.

 

I've tried trawling through the Group permissions. Can't find anything about emailing the group.

I've tried GMail settings: There's only an option to whitelist domains, no way to blacklist sending to an address.

I've tried adding Pupils to the Test group and then using Group's 'Ban' function. They can still email the distribution list.

 

Anybody have a solution?

[Jaan]

We use the "Compliance" section in Google admin panel. (apps--g-suite--settings for gmail-- advance settings)

 

We use this to stop any pupils e-mailing distribution lists or sending abusive emails directly to the head!

[Garacesh]

We use the "Compliance" section in Google admin panel. (apps--g-suite--settings for gmail-- advance settings)

 

We use this to stop any pupils e-mailing distribution lists or sending abusive emails directly to the head!

 

Could you explain how? I don't see an option for that

 

My options there are:

• Attachment compliance (Modify email based on attachment data. We have it set to strip certain attachments.)
  
• Restrict delivery (Whitelisted domains. We have our google domain whitelisted. This setting doesn't appear to have a 'blacklist sending to specific addresses' option.)
  
• Objectionable content (Your basic string-match)
  
• Append footer (Unused)
  
• Content compliance (More extensive regex string-match)
  
• Secure transport (TLS) compliance (Unused)
  

[Jaan]

Sure,

 

Lets assume we have a group called [email protected] that contains all our student users. We dont want the students to be able to email the whole dist group. In the Google admin panel, we have selected the Students OU (so not to affect the staff users).

 

 

 

Content compliance "edit" or add

 

 

edit setting

content compliance

 

1.email messages to effect;

 

Internal-sending

 

 

2.Add expressions that describe the content you want to search for in each message

 

"if ANY of the following match the message"

 

expressions

 

ADD

 

"advanced content match"

 

location

"any envelope recipient"

 

match type

"contains text"

 

Content

yourdistributionname (eg [email protected]")

 

save

 

3. If the above expressions match, do the following

reject message

 

customize rejection notice

 

"As a student, you are unable to mail official email distribution lists. If you think this is in error, Please contact your teacher or a member of the ICT support team."

 

hope that helps

[Garacesh]

expressions

 

ADD

 

"advanced content match"

 

location

"any envelope recipient"

 

How did I miss this?

Now I feel like a buffon.

 

Thanks a tonne!

 

Edit: To add to this for anybody finding this later, you can put multiple emails in the same rule, just stick it in brackets and use pipe-dividers to define OR

eg: ([email protected]|[email protected]|[email protected])

Edited July 13, 2017 by Garacesh

[Jaan]

How did I miss this?

Now I feel like a buffon.

 

Thanks a tonne!

 

Easily done when you share at a screen for any amount of time! i'd be a crap programmer! i can't spot ";"

[siuko]

Is it possible to use wildcards with this?

 

So far example [email protected] cannot email [email protected] (or any 2018 student) by using a wildcard of *[email protected]

[jthompson]

hope that helps

 

Awesome! I've been after exactly this for ages with no joy. The available settings for Google Groups just don't cut it when you're trying to do stuff like this and have been able to do it in Exchange so easily.

 

I've also just read at https://support.google.com/a/answer/1346934?hl=en that inherited compliance rules can be disabled in child OUs. That means that a compliance rule could be set for the whole domain which rejects delivery to staff mailing lists, but disabled just for the staff OU, for instance.

[Jaan]

Is it possible to use wildcards with this?

 

So far example [email protected] cannot email [email protected] (or any 2018 student) by using a wildcard of *[email protected]

 

not sure i'm afriad. We have both all students and each year group added separately.

[Garacesh]

Is it possible to use wildcards with this?

 

So far example [email protected] cannot email [email protected] (or any 2018 student) by using a wildcard of *[email protected]

 

I assume so, provided your pupils are separated by their own OU's in G Suite.

 

Example: Your new year 7's will be [email protected] and your older kids follow the same naming convention:

Advanced Content Match / Any Envelope Recipient / Contains Text / ([email protected]|[email protected]|[email protected]|[email protected]) should stop them emailing any address containing any of those strings (which are next academic year 8, 9, 10 and 11's)

 

You'll have to manually do this for each one of your year groups every year, though. And realistically you'll want to do four years either side, so you don't have to update every year. So your 2017 intake would have the rule ([email protected]|[email protected]|[email protected]|[email protected]|[email protected]|[email protected]|[email protected]|[email protected])

Edited July 13, 2017 by Garacesh

[Jaan]

what about student*@domain.com ?

[jthompson]

Is it possible to use wildcards with this?

 

So far example [email protected] cannot email [email protected] (or any 2018 student) by using a wildcard of *[email protected]

 

Presumably you wouldn't need the wildcard, just [email protected] with the option 'Contains text', given that other options include 'Ends with', 'Starts with' and 'Equals'. There's even 'Matches regex' (https://support.google.com/a/answer/1346938?hl=en).

[siuko]

I assume so, provided your pupils are separated by their own OU's in G Suite.

 

Example: Your new year 7's will be [email protected] and your older kids follow the same naming convention:

Advanced Content Match / Any Envelope Recipient / Contains Text / ([email protected]|[email protected]|[email protected]|[email protected]) should stop them emailing any address containing any of those strings (which are next academic year 8, 9, 10 and 11's)

 

You'll have to manually do this for each one of your year groups every year, though. And realistically you'll want to do four years either side, so you don't have to update every year. So your 2017 intake would have the rule ([email protected]|[email protected]|[email protected]|[email protected]|[email protected]|[email protected]|[email protected]|[email protected])

 

Ahh that does make sense... that I'm just getting it to look for text that it contains rather than having to use a wildcard for the student name!

 

I will have a try thank you

[jthompson]

If a rule is set up to reject messages using the 'Any envelope recipient' option, would it also reject the message to any other recipients?

 

For example, if [email protected] sends a message to his friend [email protected] and copies in [email protected], would a compliance rule is set to reject his message to [email protected] also reject the copy of the message going to [email protected]?

[Garacesh]

Ahh that does make sense... that I'm just getting it to look for text that it contains rather than having to use a wildcard for the student name!

 

I will have a try thank you

 

You're welcome

 

Wow, setting this profanity filter is going to take a bit of work... ((?i)(\W|^)(s|$)h(i|!|1)(t|7)(\W|$)) alone is just for the S-word.

Edited July 13, 2017 by Garacesh

[siuko]

Anyone any clues as to what this really means?

 

Any envelope recipient

 

The recipient or recipients that were reported during the SMTP communication request. These can be different from the recipients reported in the Recipient header. This can include individuals added as part of a group expansion.

 

This compares only one recipient at a time. If there are 2 or more recipients, the advanced content rule does not match against all of the recipients in one string.

[Jaan]

You're welcome

 

Wow, setting this profanity filter is going to take a bit of work... ((?i)(\W|^)(s|$)h(i|!|1)(t|7)(\W|$)) alone is just for the S-word.

 

I just imported a "naughty word list" and had a giggle at the same time.

[Garacesh]

I just imported a "naughty word list" and had a giggle at the same time.

 

Yeah, I did have a traditional list set up, but I want two different rules and G Suite doesn't seem to accommodate that. Any time I add two different 'Objectional Content' lists, they inherit each others words, and we want one list to just be binned (standard swears) and the other list to be redirected to the DCPO (things of a potential sexual nature)

[Jaan]

Yeah, I did have a traditional list set up, but I want two different rules and G Suite doesn't seem to accommodate that. Any time I add two different 'Objectional Content' lists, they inherit each others words, and we want one list to just be binned (standard swears) and the other list to be redirected to the DCPO (things of a potential sexual nature)

 

could you put one of the further up the OU?

[Garacesh]

could you put one of the further up the OU?

 

No, not unless I want to re-apply the rule again every year when new kids get introduced

Besides, the regex method takes longer, but is considerably more malleable. It'll be worth it in the long run.

[Garacesh]

Hmmm.. It appears enabling either my DCPO-redirect or the profanity filter stops any and all mail being sent.. Wut.. >.<

[siuko]

Just as an update to this

 

I was unable to use the multiple content matches like - ([email protected]|[email protected]|[email protected]|[email protected])

 

So what I did instead was

 

Our organisations are grouped in a students OU then students2017,students2018 etc below it

 

In the Gmail Advanced settings for the Students main OU I added content compliance rules for all the years as separate rules

 

Then further down the tree in each year group I just disabled that years rule

 

That way it is much quicker to add the years and just disable the one relevant to that year

[rogerdnixon]

I almost exclusively do this with group permissions rather than compliance rules (which is the other way but more effort). So for example all of our class Google Groups have the teacher as the owner and students as members. Posting is limited to owners of the group and only members can read messages but have no posign permissions. This is configured in "basic permissions" in the groups settings or but commandline using GAM.

[Garacesh]

Tearing my hair out over here. Literally the same email! It's one email with two addresses. What the hell is going on?!

 

Each entry in the list (i.e. (?i)n[i!1][g9]((\W|$)|[g9][a@4]|[s\$5z]|[g9][e3]r)) is set to 'Body', and there was literally no email body. Blank. Nada.

It just flags everything.. Cannot figure this out at all.

[jthompson]

[ATTACH=CONFIG]44537[/ATTACH]

Tearing my hair out over here. Literally the same email! It's one email with two addresses. What the hell is going on?!

 

Each entry in the list (i.e. (?i)n[i!1][g9]((\W|$)|[g9][a@4]|[s\$5z]|[g9][e3]r)) is set to 'Body', and there was literally no email body. Blank. Nada.

It just flags everything.. Cannot figure this out at all.

 

My guess is that a self-addressed email doesn't go through compliance rules. You could test that with some other compliance rule: a simple one to reject messages to a particular address, rather than one using any regex, etc.