Exchange 2016 users unable to edit Distribution Group membership using Outlook

  • [アーティクル]

I've come across a few of these cases recently and felt obligated to put up a post about this issue. Of course you can check the basics, do they have the required RBAC role, is it a Universal Security Group, etc, or any of the causes listed HERE but the cases I've had and am referring to were after migrating from Exchange 2010 to 2016, the owners of Distribution Groups could not longer edit members of distribution groups from Outlook and get the error "Changes to the public group membership cannot be saved. You do not have sufficient permission to perform this operation on this object.

The odd thing is that they are able to edit them fine in OWA, so that rules out permissions.  After getting some code-level tracing we could actually see that the processor on the server was being marked as 'unhealthy' before this operation, so it's denying the code execution, not denying the user permission to edit group membership which is the confusing part. 

Without getting into too much detail, there are calculations in the Exchange code which can mark the processor(s) as unhealthy, and in many cases it's due to the Exchange Servers having more CPU cores than our recommendations, which you can find here in Jeff Mealiffe's blog on the Exchange Team site How Big is Too Big?

In the handful of recent cases we've had, the following settings were changed to correct the CPU issues we were seeing
- Disable Hyperthreading on the Exchange Servers
- Set the NUMA BIOS settings to "Flat" instead of "Clustered"

I'm sure everyone knows about Hyperthreading and Exchange by now. The NUMA setting is set in the BIOS and can actually throttle CPU as well and degrade Exchange performance. Both of the above items are covered in our Exchange Health checker script, so they should be addressed anyways to be in a best practice configuration.  You can download that script here if you want to be proactive about it:  Exchange Health Checker

Worst case scenario and this does not resolve your issue, you're in a better configuration than previously. Hope that helps!