Office 365 Email Segregation

[themightymrp]

I think I may have an issue with my student GAL Once I set the students to be hidden from address lists, they a) don't appear as members of my 'AL_Students' and b) are unable to receive any email! They can send them though :-/

 

The error I get back when I email them is

 

Diagnostic code = NoDiagnostic; Reason code = TransferFailed; Status code = 532
           

 

If I unhide them they receive emails fine - but then they appear in the contacts of staff which I don't want.

 

Any ideas?

[jamesbmarshall]

This is one of those times where I wish I'd bookmarked the page where I saw this information... I think there is/was a bug if you used ABPs and hiding from address lists together which caused some interesting routing issues but I can't put my hands on the page now!

 

Log a service request.

 

 

EDIT: Found it! See the response from Greg Taylor: Exchange 2013 Address Book Policy Routing Agent Issue with Mailboxes Hidden From the Address Lists

[themightymrp]

So its a bug with no solution as yet May have to modify things slightly then....

[jamesbmarshall]

Do your staff not have an ABP which does not​ include the student AL?

[themightymrp]

Actually no, that would have been a good idea I realize now. I thought I could have got away without it if I hadn't come across this bug. However I am now creating a staff ABP

[jamesbmarshall]

However I am now creating a staff ABP

 

Good man! Clearly, the bug needs fixing, and I'm sure it will but for now that's probably the more ... logical? way to handle it!

[themightymrp]

Any idea how long it takes to populate address lists etc with names based on a recipient filter? I am only assigning it to me at the moment and so far so good but it hasn't got a complete list of staff......

[Boredguy]

It can take a couple of hours.

 

I created a new Address list yesterday, but it wasn't until an hour after I created the Offline Address book referencing it today, that entries appeared.

[themightymrp]

OK, daft question - why when I try to untick the "Hide from address lists" box for a student do I get the following error?

 

The operation on mailbox "XXXX" failed because it's out of the current user's write scope. The action 'Set-Mailbox', 'HiddenFromAddressListsEnabled', can't be performed on the object 'XXXX' because the object is being synchronized from your on-premises organization. This action should be performed on the object in your on-premises organization.

 

This also happens from Powershell. It must have worked before because I hid them en-masse using a piped powershell command!!

[jamesbmarshall]

If you're syncing with your local AD you need to set the attribute in AD and wait for DirSync to push it back up!

[themightymrp]

Where do I set it in AD?? Bear in mind that we don't have (and never have had) an onsite Exchange server. Am I supposed to extend the Schema in some way to allow more details? If so, anyone got a quick how-to guide? Strange that I hid them originally from the powershell though :-/

[jamesbmarshall]

Yes - you absolutely need to have extended your schema!

 

Very simple process but obviously, messing with AD can have unintended consequences so proceed with caution. I don't have a guide handy, but I'm sure quick search will turn something up. The important thing to know is that you don't have to deploy Exchange to get the attributes, but without Exchange locally to provide the EMC you'll have to edit the additional attributes using ADSI Edit or something.

[themightymrp]

Riiiiiiigght! Ok then! I shall have a nosey at doing that tomorrow then. Using ADSI Edit is not a problem, I just need the attributes to edit! Which version of Exchange should be used to work with the latest version of 365? Or does it matter?

[jamesbmarshall]

Newer is better - so Exchange 2013

 

I believe the attribute you need is msExchHideFromAddressLists.

[themightymrp]

With regards creating a staff ABP this seems to work However, looking in the list of contacts I can't see a Dynamic Distribution List I setup which contains all staff accounts. Am I missing something to show this? I am only testing the policy on my account so far. If I log in as a member of staff without the policy applied, I can see the Distribution Lists under the 'Directory' group.

 

Also, I assume when creating the policy, if I want to include the "All Groups" address list I can do this by comma separating the lists in the command line?

 

 

EDIT

 

Have managed to add the "All Groups" to my staff address book policy. But it still doesn't show my dynamic list anywhere??? How do I add this and where is it stored?

Edited September 19, 2013 by themightymrp

[Boredguy]

I've not managed to get DDL to appear in the address books, but I think that is a "design feature". Not given up yet but have put it on a low priority to resolve.

[themightymrp]

Think I need to include something like the following in one of the address list filters:

 

-or (ObjectClass -eq 'msExchDynamicDistributionList')

[themightymrp]

Does this look about right? Think I have brackets in the right place...

 

set-addresslist -identity "AL_Staff" -recipientfilter {((Company -eq 'School Staff') -and (RecipientType -eq 'UserMailbox')) -or (ObjectClass -eq 'msExchDynamicDistributionList')}

[themightymrp]

Still can't get this to show my Dynamic Distribution List as part of the staff GAL. Can someone check this output (trimmed to show relevant data) to see if I have done this right?

 

get-globaladdresslist GAL_Staff | select recipientfilter

((((Company -eq 'Name of School') -and (RecipientType -eq 'UserMailbox'))) -or (ObjectClass -eq 'msExchDynamicDistributionList'))

 

 

 

get-addressbookpolicy ABP_Staff

AddressLists       : {\BSS_Staff, \All Groups}
GlobalAddressList  : \GAL_Staff
RoomList           : \All Rooms
OfflineAddressBook : \OAB_Staff

 

I have checked to make sure the Dynamic List has not been set to 'hide from address lists'

 

Cheers

[themightymrp]

Anyone???

[themightymrp]

Well it hasn't bloomin worked! Have tried getting funky now and adding the Dynamic Group specifically to the GAL using this command (see below). Will see if it updates to include it but I'm not hopeful

 

set-globaladdresslist -identity "GAL_Staff" -recipientfilter {(DistinguishedName -eq 'CN=Staff Distribution List,OU=SchoolName.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=EURPR07A001
,DC=prod,DC=outlook,DC=com') -or ((Company -eq 'Name of School') -and (recipienttype -eq 'UserMailBox'))}

[Boredguy]

They've not yet appeared in my lists yet, not even the global master one

[themightymrp]

A quick question before I extend my AD schema to support Exchange. Do I just need to run the set.exe /PrepareSchema command? Or do I also need to run the other commands such as setup.exe /PrepareAD ??

 

Cheers