GAFE/GSFE: Stop users being able to email distribution lists

[Garacesh]

OK, the order that I have them in my Powershell scripts is .*? (Context: if ($Log.ReplacementStrings[1] -imatch "^S-1-5-21.*?500$") {)

Don't know if that'll work in Google, but it's worth a shot.

Edited February 27, 2018 by Garacesh

[enjay]

(?i)abc-students-([a-z0-9]|-) @example\.com

 

So, that should pick up [email protected] and also [email protected], correct? (the space before the @ was Edugeek trying to format the mention, not part of your syntax, yes?)

I'll give that a try...

 

- - - Updated - - -

 

Salamander already does that. At least, they did for us? Kids are automatically added to the right classes in Classroom whether they like or not (and this happens daily to re-add leavers.. wish you could turn unenrolling off...)

It creates the groups in AD, yeah, but you don't have to upload those groups to Google. We don't. The only Salamander groups we push up to Google are Year-X-Pupils and All-Staff.

 

I'll speak to Salamander about that. I would still need these rules to stop students emailing these groups, though...

[Garacesh]

I'll speak to Salamander about that. I would still need these rules to stop students emailing these groups, though...

Not really. You only need to add those mail rules if you upload the groups to Google, which you don't need to do.

 

Salamander creates the class/form/etc groups in our AD and adds the relevant pupil accounts (MemberOf) to those groups, but those AD groups don't get matching Google groups created for them. Nobody can email them because the (Google) group doesn't exist. There's no mailing list to send email to.

 

You can control which groups get synced with the cloud via your Google sync tool of choice (I use Google Cloud Directory Sync) and LDAP filters.

 

We have Salamander append all the groups they create with s-, so for example, the LDAP query (&(objectCategory=group)(cn=s-Year*Students)) uploads the Year 7, Year 8, etc groups, but the class groups (eg, s-102-CS1, which I think is Year 10 Computer Studies) don't get matched. Salamander still does all the Google Classroom stuff without the groups getting pushed to the cloud.

[enjay]

Not really. You only need to add those mail rules if you upload the groups to Google, which you don't need to do.

 

We would still need year group distribution lists, but I could block those specific addresses in the compliance control.

[Garacesh]

Oh yeah I completely get that. My point is there's probably no reason to actually upload the class-list groups if you get Salamander to sort out all the Classroom stuff itself.

 

Just blocking year group lists is easy, you can either just add them individually with something like (?i)(^([email protected])) or by a broader regex if you can get them all using the same naming convention, such as (?i)(^(year(7|8|9|10|11)@yourschool.gtld)

 

When setting mailing list rules I'd recommend you use the Caret (^) for matching emails, as it denotes the start of a string.

Probably not so useful in this context, but a bit more useful when you might be doing [email protected] and then you've got a user like TannerE

[ADMaster]

So, that should pick up [email protected] and also [email protected], correct? (the space before the @ was Edugeek trying to format the mention, not part of your syntax, yes?)

I'll give that a try...

 

mostly yes,

I should have enclosed it in code tags.

the space should have been a plus sign +

every full stop / period should be escaped with a back slash \ it almost looks like a pipe the way it is formatted now.

also if you include the dash in the brackets as part of the range of characters escaping the dash, it will work the same as including it in the parenthesis with the pipe | OR

These two appear to function the same.

(?i)abc-students-[a-z0-9\-]+@school\.org\.uk

(?i)abc-students-([a-z0-9]|-)+@school\.org\.uk

[enjay]

Hmm, still not getting this working. I have the regex rule (?i)abc-students-([a-z0-9]|-)@school.org.uk set up but was still able to send an email to [email protected]

 

The simple rule (?i)[email protected] blocks the email so the rules are definitely applying.

[Garacesh]

every full stop / period should be escaped with a back slash \ it almost looks like a pipe the way it is formatted now.

I've found - with G Suite mailing rules at least - that you don't need to escape periods.

 

Perhaps this means .*? won't work, as they might just ignore that as a special character.

Hmm, still not getting this working. I have the regex rule (?i)abc-students-([a-z0-9]|-)@school.org.uk set up but was still able to send an email to [email protected]

 

The simple rule (?i)[email protected] blocks the email so the rules are definitely applying.

 

Edit: Ignore the previous. According to regex101, [ ] only matches one character.

Edited February 27, 2018 by Garacesh

[enjay]

Is there a regex I could use which would look at the start of the email address only, e.g. flag any email address beginning with abc-students or with 7|8|9|10|11 ?

[Garacesh]

Is there a regex I could use which would look at the start of the email address only, e.g. flag any email address beginning with abc-students or with 7|8|9|10|11 ?

 

I've just tested it with Google's own regex test, and it turns out it does accept .*?

 

(?i)(^((ABC-Students-)(.*?)@yourdomain.gtld)) works.

Literally matches abc-students-ANYTHINGEHGIWEHG£W(T"£HTG"W([email protected]

[enjay]

I've just tested it with Google's own regex test, and it turns out it does accept .*?

 

(?i)(^((ABC-Students-)(.*?)@yourdomain.gtld)) works.

Literally matches abc-students-ANYTHINGEHGIWEHG£W(T"£HTG"W([email protected]

 

I've copied and pasted that into my settings. Let's see what happens...

[enjay]

I've just tested it with Google's own regex test, and it turns out it does accept .*?

 

(?i)(^((ABC-Students-)(.*?)@yourdomain.gtld)) works.

Literally matches abc-students-ANYTHINGEHGIWEHG£W(T"£HTG"W([email protected]

 

That worked!

 

I think my earlier ones might have actually been working too, but Google Mail was being too clever for itself. At first, I had used the address testing@ before changing this to 7-testing@, so even though I was typing 7-testing@ the auto-complete was picking up testing@ from the history and consequently not blocking it.

[Jaan]

Did anybody figure out why the custom message isn't displayed to end users when their emails are rejected?

 

We're having an issue where a user thinks that they have send an email, where in reality it has been silently dropped/rejected with making them aware.

 

Cheers

[mca91601]

These settings worked for my situation, thank you!

[mca91601]

Sorry to bring up an old thread - I made the compliance rules as described and it worked. However, when a student account tries to e-mail individual faculty - they get the "blocked" email that is set up for the compliance rule. The rule ONLY has the distribution groups. Any ideas what to check?