Access to Global Address List for Students

[LeonieCol]

We have recently put out students onto Excahnge for their email.

 

The only thing is, there are various staff groups set up on the GAL, which we would rather students did not have access to, as they like to email random pictures and messages to large groups of staff!

 

Is there any way to either i) hide GROUPS from the GAL, so that they only appear in the 'All groups' drop down, or ii) make the GAL invisible to a group of people (students). I have tried changing the permissions through Excahnge System Manager, so that students cannot view the GAL, but this does not seem to work. (It does, however, work for other address lists).

 

Any help appreciated.

[cjwhite]

I wont take any credit for this, I was sent it by another school techy, but I think its what your after...

 

 

For reference this is what I have been following:

 

Exchange_Genie: Hidding Global Address Lists (GAL) with Exchange 2007

 

And here is a similar MS article How to restrict OWA address searches to multiple organizational units

 

 

 

You’ll need to download the ADSIEdit.msc which is part of a tool set for windows server 2003

 

The eventual aim is to have a student user who can only use OWA only seeing a student GAL and staff only seeing a staff GAL in O2007 and OWA

 

 

 

Basically what I did was:

 

Followed the article I linked to, to create the new GAL, and then downloaded a piece of software from the MS website to change on bulk users in AD (you can use ADinfinitum I would think but the software, admodify, does all that does and its free – let me know if you want it as I cant remember the link)

 

I changed three settings for the students-

 

-I got the DN of the GALs I created from ADSIEdit (Domain > Config > Services > MS Exchange > Global Addresses) and then stuck them in the msExchQueryBaseDn using the ADmodify sw

 

 

-Following on from that article I gave each student a customattribute15 of student (this populates the Student GAL as it will only include those with this custom attribute.)

 

 

-I selected to hide all the students from the GAL option

 

This leaves us with the students hidden from the main GAL, so staff can still create and use distribution lists, and students can only see a blank GAL in OWA and the same in outlook, as I denied them access to the default GAL using ADSIEdit again (Right click on it, properties security tab deny read and view list access to the students or similar security group).

 

The one downside is that with all the kids hidden they cant have their own GAL of just students, unless I do the same for staff as students, but I then cant have the distribution lists for staff as they dont appear to work in the GALS I created.

[jsnetman]

I also restrict the amount of users that a pupil can email to, set it to 10 as there is not any good reason why a pupil should be able to email a whole group of users. Admodify is a good tool to use to edit email and other properties of multiple user accounts.