Stuck blocking students from emailing distribution lists

[CHiLL]

We're trying to figure out how to block students from emailing other distribution lists, but can't seem to get the rule working.

 

If Sender is a member of this group - The sender is a member of '[email protected]'
and 
The recipient address includes any of these words - The recipient address contains any of these words 'intake' or 'allstudents' or 'students-' 
Do the following
Block the message - reject the message and include and explanation - Reject the message with the explanation 'Not allowed'
And
Block the message - reject the message with the enhanced status code of '5.7.1'

 

That reads as though it should work, but it doesn't, emails go through anyway.

 

We've tried all sorts of combinations of options, but cannot get it to work.

 

Ultimately, we want it so that no student can email distribution lists that either start with or contain specific words. For example, instead of entering each intake year individually, we'd like to just have 'intake' to catch them all. This is also the same for each class group that we have - as each Teams group has it's own unique email address, but they all start with the same pattern. Using that pattern would save manually entering dozens manually each year.

[howartp]

We kinda do the inverse.

 

All mailing lists have the property "Delivery Management: Only allow members of this group to send to this mailing list: "All Staff" set.

 

(This is on-prem Exchange but i'm sure the same setting will exist on 365)

[CHiLL]

We kinda do the inverse.

 

All mailing lists have the property "Delivery Management: Only allow members of this group to send to this mailing list: "All Staff" set.

 

(This is on-prem Exchange but i'm sure the same setting will exist on 365)

Thanks, though I can't seem to find an equivalent attribute in Attribute Editor on our AD security group. I'll keep digging.

[IT_Man_Dan]

Ok, so we do it slightly differently through powershell by setting the dlmemsubmitperms attribute to only the groups of users we want to be able to email the group.

 

Using this powershell command

Set-ADObject "distinguished name of group you are trying to restrict here" -Add @{dLMemSubmitPerms="distinguished name of group you want to be able to send to group"}

 

distinguished name can be retrieved from attributes tab in AD.

Once above script run on a group you can then add extra groups via the attributes tab dlmemsubmits perms bit if needed.

[howartp]

 

It's in Exchange admin centre.

[3s-gtech]

We kinda do the inverse.

 

All mailing lists have the property "Delivery Management: Only allow members of this group to send to this mailing list: "All Staff" set.

 

(This is on-prem Exchange but i'm sure the same setting will exist on 365)

 

This is how we do it. This syncs up to EOL. Also stops spam etc reaching the groups.

[CHiLL]

[ATTACH=CONFIG]70511[/ATTACH]

 

It's in Exchange admin centre.

Unfortunately those options aren't there if the groups are created and synced from an on-premise AD.

 

Ok, so we do it slightly differently through powershell by setting the dlmemsubmitperms attribute to only the groups of users we want to be able to email the group.

 

Using this powershell command

Set-ADObject "distinguished name of group you are trying to restrict here" -Add @{dLMemSubmitPerms="distinguished name of group you want to be able to send to group"}

 

distinguished name can be retrieved from attributes tab in AD.

Once above script run on a group you can then add extra groups via the attributes tab dlmemsubmits perms bit if needed.

Ahh, OK! I can see that entry in Attribute Editor:

[ATTACH=CONFIG]70512[/ATTACH]

Hopefully setting that to the "All staff" group would work. I'll give it a go with a test group I've synced.

 

Edit: Sadly I cannot do it in Attribute Editor, as when I edit that field, I get an error message: "There is no editor registered to handle this attribute type.". Guess I'll have to do it the Powershell way like you suggested!

Edited December 15, 2023 by CHiLL

[3s-gtech]

Is this any help?

https://learn.microsoft.com/en-us/exchange/manage-hybrid-exchange-recipients-with-management-tools

You'd need to have Exchange still active in your AD, but you don't need a running server.

[CHiLL]

Is this any help?

https://learn.microsoft.com/en-us/exchange/manage-hybrid-exchange-recipients-with-management-tools

You'd need to have Exchange still active in your AD, but you don't need a running server.

Ah, nevermind then. We've not had an on-prem exchange server on this domain. We started from scratch in 2015 and prior to that (and my employment), we were using a hosted Zimbra solution. I'm not sure I want to start installing exchange stuff now, for the risk of breaking things.

[3s-gtech]

No, avoid the complexity and stay away. It does limit some of your (easy) control though, so you'll need the v3 module and Powershell to do it!

[IT_Man_Dan]

Unfortunately those options aren't there if the groups are created and synced from an on-premise AD.

 

 

Ahh, OK! I can see that entry in Attribute Editor:

[ATTACH=CONFIG]70512[/ATTACH]

Hopefully setting that to the "All staff" group would work. I'll give it a go with a test group I've synced.

 

Edit: Sadly I cannot do it in Attribute Editor, as when I edit that field, I get an error message: "There is no editor registered to handle this attribute type.". Guess I'll have to do it the Powershell way like you suggested!

 

Yes it has to be done in powershell sadly as you get the error you mention above otherwise.

It work's well though. I've done it with all my on prem distribution groups that sync to the cloud.

[CHiLL]

Yes it has to be done in powershell sadly as you get the error you mention above otherwise.

It work's well though. I've done it with all my on prem distribution groups that sync to the cloud.

Cheers. I'm just trying to figure out the Exchange Online Powershell command to change that flag. I can see it with:

Get-DistributionGroup -Identity 'DsitributionGroup' | Select-Object 'dLMemSubmitPerms'

I just can't remember how to modify that value.

[IT_Man_Dan]

Cheers. I'm just trying to figure out the Exchange Online Powershell command to change that flag. I can see it with:

Get-DistributionGroup -Identity 'DsitributionGroup' | Select-Object 'dLMemSubmitPerms'

I just can't remember how to modify that value.

 

You set it in powershell with AD module.

[IT_Man_Dan]

You set it in powershell with AD module.

 

As in start powershell with AD and use the following command, setting the distinguished names to what you need.

 

Set-ADObject "distinguished name of group you are trying to restrict here" -Add @{dLMemSubmitPerms="distinguished name of group you want to be able to send to group"}

 

Then after the next sync runs (or you can force a delta sync) it then sets it up in 365.

[CHiLL]

As in start powershell with AD and use the following command, setting the distinguished names to what you need.

 

Set-ADObject "distinguished name of group you are trying to restrict here" -Add @{dLMemSubmitPerms="distinguished name of group you want to be able to send to group"}

 

Then after the next sync runs (or you can force a delta sync) it then sets it up in 365.

Thanks, the issue that led to me looking into this has fried my brain today. I've ran the command and can see it has written to AD. I'll check on Monday whether my test user in that test group can send to it.

[CHiLL]

As in start powershell with AD and use the following command, setting the distinguished names to what you need.

 

Set-ADObject "distinguished name of group you are trying to restrict here" -Add @{dLMemSubmitPerms="distinguished name of group you want to be able to send to group"}

 

Then after the next sync runs (or you can force a delta sync) it then sets it up in 365.

I can confirm that running that script with my test group details, it worked! The user gets an automatic denied email bounce back email when they try. I'm going to ask Salamander to apply that setting to all our students/class/teams email groups and also for future groups that are created.

 

Thanks for your help!