Exchange Server on-premises, is there a solution that prohibits users to expand members of distribution groups in the address book?

Jayden_CW 0

Exchange Server deployed on-premises, is there a solution that prohibits users to expand the members of distribution groups in the address book? Currently tried to set it in the AD group object, with powershell command Set-ADGroup -Identity "groupname" -replace @{hideDLMembership=$false};

Once set, in OWA and the Windows outlook client, you can disable expansion and can't view group members. However, if you use the MAC client, you can still access and view the group members normally.

Is there a feasible solution for the on-premises Exchange Server system to prevent users from viewing and expanding distribution group members? Thank you

Mike Hu-MSFT 4,135 Reputation points Microsoft Vendor

2024-09-10T05:53:09.9733333+00:00

Any updates so far? If you have solved your problem, could you share with us? Maybe it will help more people with similar problems. Don't forget to mark it as answer, this will be easy for other community members to find the useful one.

2 answers

Mike Hu-MSFT 4,135 Reputation points Microsoft Vendor

2024-09-03T07:09:53.4933333+00:00
Hi,

Welcome to the Microsoft Q&A platform!

You can try to use the Add-ADPermission cmdlet to set permissions.

For example, to prevent a specific user or group from expanding a distribution group:

Add-ADPermission -Identity "DistributionGroupName" -User "UserOrGroupName" -Deny -ExtendedRights "Read Members"

More details about this cmdlet you can refer to:Add-ADPermission

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer!
Please sign in to rate this answer.
Jayden_CW 0 Reputation points

2024-09-03T09:52:06.62+00:00

Thank you for replying.

It indicates that there is no such ExtendedRights "Read Members" .

CategoryInfo : NotSpecified: (:) [Add-ADPermission], ManagementObjectNotFoundException ategory=Cmdlet-ManagementObjectNotFoundException] 663A9876,Microsoft.Exchange.Management.RecipientTasks.AddADPermission
What is the correct ExtendedRights

Mike Hu-MSFT 4,135 Reputation points Microsoft Vendor

2024-09-05T07:06:58.4766667+00:00

My mistake, that method may not be effective. It is recommended that you use ABP to implement the partitioning.

Create ABP: In the Exchange Admin Center (EAC) or using PowerShell, create an ABP.

New-AddressBookPolicy -Name "RestrictedABP" -AddressLists "RestrictedAddressList" -GlobalAddressList "RestrictedGAL" -OfflineAddressBook "RestrictedOAB" -RoomList "RestrictedRooms" -PolicyScope "LimitedScope"

Assign ABP: Assign the ABP to the specific users.

Set-Mailbox -Identity "username" -AddressBookPolicy "RestrictedABP"

More details you can refer to:https://video2.skills-academy.com/en-us/exchange/email-addresses-and-address-books/address-book-policies/abp-procedures?view=exchserver-2019
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Andy David - MVP 149K Reputation points MVP

2024-09-03T10:30:39.0433333+00:00

I'm not aware of any way to prevent that.

Hiding the members is not the same as preventing expansion.

The only way to prevent users from expansion would be to use a dynamic distrib group.
Please sign in to rate this answer.
Jayden_CW 0 Reputation points

2024-09-04T09:25:32.8033333+00:00

Thank you for replying.
Yes. Hiding the didtribution group is an effective way, but it's not user-friendly.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Exchange Server on-premises, is there a solution that prohibits users to expand members of distribution groups in the address book?

2 answers

Your answer