To recapitulate, how it’s done and what the final result looks like in legacy versions of Exchange, I am documenting the steps below. Post that we’ll see what’s the change in Exchange 2010 and how to deal with it.

It will be easier to convey and absorb the concept with an example, so let’s consider following scenario.

Exchange Server 2003

There is a team of IT experts with members – Antony Edwards, Brendon Frank, Charles Gomes, Douglas Huston and Sherlock Irwin.

Now, the requirement is that there should be a distribution group for the team, with Sherlock as the owner, and the group membership should be visible to only him.

So, the IT Admin performs the following steps.

1. Creates a distribution group Subject Matter Experts. [ Group type: (Security), Scope: (Global)]

2. On the Managed by tab of the Group properties page, makes the following modification.

The above two steps are performed in Active Directory Users and Computers console on Exchange Server 2003.

Now, we’ll create Outlook 2010 profile in Exchange Online mode for Sherlock and Charles. Just to see how it appears.

Since the objective is to ensure that the membership is visible only to the owner, we set the attribute hideDLMembership through ADSIedit.msc tool to TRUE from <Not Set> - the default.

Now, both Sherlock & Charles close their Outlook client and re-launch it. The distribution group membership page appears as below in their Outlook profiles.

So, we have achieved the desired. The distribution group owner can see the membership information, but distribution group members can’t.

On an existing message, the distribution group owner will be able to expand the distribution group and will be able to see membership, but member will receive following error.

Now, this is all from client perspective.

From the Server end as well, the membership will appear blank.

Now, what if Sherlock wants to add a new member? Will he be able to do so?

The following error pops up.

Changes to the public group membership cannot be saved. You do not have sufficient permission to perform this operation on this object. 

To make it work, we need to set the check box “Manager can update membership list”.

As you’ll notice, it’s grayed out. Reason – the hideDLMembership attribute is set to TRUE.

We need to set it to <Not Set> in ADSIedit, then select the check box here in Active Directory Users & Computers, and again set the value for the hideDLMembership attribute to TRUE.

Exchange Server 2007

Exchange Server 2010

With Exchange Server 2010, things change a little bit. Two aspects that need to be considered - RBAC & Address Book Service.

Let's go by an example.

We have mailbox-enabled users Jeff Oscar , Kevin Pascal, Laura Qunitero, Mike Ruth and Noel Swan on Exchange Server 2010.

We have a distribution group - Escalation Services, Noel Swan being the distribution group owner.

If the distribution group owner has mailbox on Exchange 2010, then even he can’t see the membership details, if hideDLMembership attribute is set to TRUE.

It’s something like below.

In addition, if the owner attempts to modify the membership of the distribution group through Outlook, following message pops up (even though the check box “Manager can update membership list” is selected).

So, for both issues the reason(s) there are couple of different workaround(s).

In Exchange 2010, with the introduction of RBAC, we have to perform some additional steps to ensure that the owner can modify the membership (even with the check box “Manager can update membership list” selected.).

The steps are documented in KB 982349 “Changes to the distribution list membership cannot be saved" error message when you try to remove members from an Exchange Server 2010 distribution list”

Solution 1: If you just want to enable the owner to modify the distribution group membership (with membership hidden for owner as well), then just run following commands - (i) to create a new role group, (ii) add Noels as member, (iii) and verify the membership.

[PS] C:>New-RoleGroup DistributionGroupManagement -Roles "Distribution Groups"

Name
----
DistributionGroupManagement

[PS] C:>Add-RoleGroupMember DistributionGroupManagement -Member Noels
[PS] C:>Get-RoleGroupMember DistributionGroupManagement

Name
----
Noel Swan

Now, the distribution group membership can be modified by the owner via Outlook client (obviously only additions, as s/he can't see the membership).

Solution 2: If you want to enable the owner (a) to view distribution group membership (b) to modify distribution group membership through Outlook client, then just hard code the Outlook client to talk to closest GC, by following the KB 319206 “How to configure Outlook to a specific global catalog server or to the closest global catalog server”.

HKEY_CURRENT_USERSoftwareMicrosoftExchangeExchange Provider
On the Edit menu, click Add Value, and then add the following registry value:

Value name: DS Server
Data type: REG_SZ (string)
Value data: FQDN of the global catalog server

And, one more interesting aspect that I would like to mention.

If, following conditions are true..

1. The check box for "Manager can update membership list" in Active Directory Users and Computers is not selected on the Distribution Group property.
2. Distribution Group owner has been provided appropriate RoleGroupMembership [ RBAC "Distribution Groups"].

[ These will be the most likely situations when the distribution group and distribution group owner are created via Exchange Management Console in Exchange Server 2010 environments.]

Then, the result as observed by Distribution Group owner via Outlook client will be as follows.

1. Without "DS Server" registry key  --

   a. Will not be able to see membership in Outlook client.

   b. But will be able to add members to the distribution group via Outlook client

2. With the "DS Server" registry key --

   a. Will be able to see membership in Outlook client.

   b. But will not be able to remove/add members to the distribution group via Outlook client.

So, the solution -- ensure that the check box "Manager can update membership list" is selected, if you want the distribution group owner to see & modify the membership.

 I hope this helps.

Kamlesh Kumar

Since the version of Exchange installed was Exchange Server 2007, we didn’t have option of running cmdlet Remove-MailboxFolderPermission that’s available in Exchange Server 2010. The option left was to use PFDAVAdmin tool. And, again if you have not explored this tool thoroughly, finding that option can be quite a time consuming effort.

So to share my knowledge and save your time (if you are stuck in similar situation and are looking for way out) I have documented the steps below.

1. Double click on PFDAVAdmin, and then click on File -> Connect.
 

2. In the Connect window, in the Server and authentication section, enter the details for your Exchange Server and Global Catalog and ensure that the check box for Authenticate as currently logged-on user is selected. (It’s understood that you have logged on to the Server using the credentials of Exchange Admin account.)

Under the Connection section ensure that All Mailboxes is selected.

 
3. Once you click on OK following screen appears.
 

4. If you click on the + symbol in front of Mailboxes, all mailboxes hosted on that Server are listed out.
 

5. Highlight on Mailboxes, click on Tools, then Custom Bulk Operation. The Custom Bulk Operation window opens up.

  
6. In the Custom Bulk Operation window, clicking on Add will bring up the Operation Type window as shown below.
 

Select the Folder Permissions option from the Operation type and click on OK it will open the Folder Permissions Op window.

7. In the Folder Permissions Op window, in the Action section select Replace.

Clicking on Select under Input for Merge or Replace section will bring the following message (You will now be presented with a permissions dialog you can use to configure the permissions that will replace all existing permissions on the folders):
 

Click on OK, and the Permissions window opens up.

 8. In the Permissions window, ensure that default permission for NT AUTHORITY\ANONYMOUS LOGON and \Everyone with Role of None are present.

 
9. Clicking on OK in the Permissions window will take us back to the Folder Permissions Op window with the default permissions (or that selected in the previous step) populated.

10. Clicking on OK in the Folder Permissions Op window will show the Custom Bulk Operation window with the permission that we want to apply on the folders in the mailboxes.

Clicking on OK will apply the requisite permissions.

I hope you find it useful.

I have seen few cases where customers have felt the need to restrict the access to snap-ins that they feel their front-line Admin or Helpdesk professional should not have. It’s a security concern to them.

We all know that the access to snap-ins can be restricted via group policy settings. By default the snap-ins that are available for administration via GPO are – Active Directory Users and Computers, Active Directory Domains and Trusts, Active Directory Sites and Services, ADSI edit, ActiveX Control, Certificates, Certification Authority, Certificate Templates, Wireless Monitor, Component Services, Computer Management, Device Manager, Disk Management, Disk Defragmenter, Distributed File System, Event Viewer, Fax Service, FrontPage Server Extensions, Indexing Service, .Net Framework Configuration, Internet Authentication Service (IAS), Internet Information Services, IP Security Policy Management, IP Security Monitor, Link to Web Address, Local Users and Groups, Performance Logs and Alerts, QoS Admission Control, Remote Desktops, Removable Storage Management, Routing and Remote Access, Security Configuration and Analysis, Security Templates, Services, Shared Folders, System Information, Telephony, Terminal Services Configuration, WMI Control. In addition to these, we have few Extension Snap-ins such as AppleTalk Routing,Authorization Manager, Certification Authority Policy Settings, Connection Sharing (NAT), DCOM Configuration Extension, Device Manager, DHCP Relay Management, Event Viewer, Extended View (Web View), IAS Logging, IGMP Routing, IP Routing, IPX RIP Routing, IPX Routing, IPX SAP Routing, Logical and Mapped Drives, OSPF Routing, Public Key Policies, RAS Dialin - User Node, Remote Access, Removable Storage, RIP Routing, Routing, Shared Folders Ext, Send Console Message, Service Dependencies, SMTP Protocol, SNMP, System Properties.

But, if you notice, we don’t have for all applications that are used. Say, for example, Exchange Server 2007 MMC or Public Folder Management Console MMC etc. And, there are no ADM templates either of all the applications. Then, how do we go about managing access to those snap-ins?  

There is a way that most of the experienced Admins might be aware of, but it’s not documented properly. And, that led me to blog this information.

First Step

To restrict access to a snap-in or file or a process or a service we need to know the associated registry key. Once that is done the task becomes moderately easy!

As I want to restrict access to the Exchange Management Console snap-in, I need to identify the corresponding registry key for Exchange Management Console.

The registry keys for all snap-ins that are installed/available on the box is at the location

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns

On my Windows 2008 box (that has just Exchange Server 2007 and Windows Support tools), there are close to 100 entries. To identify the one that’s for Exchange Management Console, I have to look under each one manually (that’s pain, I have not been able to find out a quicker way yet) and keep my eye focused on the REG_SZ entry with the name NameString. This entry is the tag of the snap-in that’s associated with that particular registry key.

For Exchange Management Console the registry key is  FX:{76dd58f7-54ba-42e3-a2e0-dbf4b674539f}

Similarly, for the Public Folder Management Console, the registry key is FX:{7a7e61b7-e5c8-4d65-904e-f26589b6c1e3}. You can scan for other snap-ins that you want.

Second Step

Create a custom ADM template. The process is quite simple. Refer the KB https://support.microsoft.com/kb/323639 under the section How to Create an Administrative Template.

For creating adm template for Exchange Management Console, I type in the following lines in a text file and save it as a .adm file.

CLASS USER

CATEGORY Software\Policies\Microsoft\MMC

  POLICY FX:{76dd58f7-54ba-42e3-a2e0-dbf4b674539f}

  KEYNAME Software\Policies\Microsoft\MMC\FX:{76dd58f7-54ba-42e3-a2e0-dbf4b674539f}

    PART Restrict_Run NUMERIC

    VALUENAME "Restrict_Run"

    END PART

  END POLICY

END CATEGORY

The file is saved as ExchangeManagementConsole.adm

Third Step

Now, we need to import the custom adm template created in the previous step, in the Group Policy Management Editor and do the changes accordingly. The steps are:

1.      Launch Group Policy Management console on the Server.

2.      Locate the Default Domain Policy Group Policy Object and do a right-click on it and choose Edit from the context menu. It will open the Group Policy Management Editor.

3.      Expand User Configuration,, Policies  and locate Administrative Templates: Policy definitions (ADMX files) retrieve from the local machine. and right-click on it and choose Add/Remove Templates from the context menu. Click on the Add button and add the custom adm template

ExchangeManagementConsole.adm  (I hope you recall, where you saved it after creating it.)

4.      Once you are done with adding the template, it will appear under Classic Administrative Templates (ADM) under Administrative Templates: Policy definitions (ADMX files) retrieve from the local machine.

5.      It will appear as Software\Policies\Microsoft\MMC, and in the right pane you’ll see it with the name FX:{76dd58f7-54ba-42e3-a2e0-dbf4b674539f}

6.      Double-click on FX:{76dd58f7-54ba-42e3-a2e0-dbf4b674539f}, and select the radio button for Enabled and for the Restrict_Run attribute set the value to 1.

Fourth Step

Go ahead and run the command gpupdate /force to make the change effective immediately.

Now, if you try to launch the Exchange Server 2007 MMC, [Start | Programs | Microsoft Exchange Server 2007 | Exchange Management Console] you’ll get the following error:

And, if you try to add it through MMC [File | Add or Remove Snap-ins], the snap-in (as expected) should not appear there.

Note:

1.      This applies to Exchange Server 2007 MMC only.

2.      The policy is being applied at Domain level. It can be done at OU level as well.

The same procedure can be followed to restrict access to any snap-in. I hope you find it useful.

On most of the occasions,  I have found that we are perplexed about the part played by Outlook client and the part played by the Autodiscover service. So, to share my understanding of the process, after referring all the official document, available at Microsoft TechNet sites I am documenting the steps below.

There are three phases in complete Outlook 2007 profile configuration when the mailbox is on Exchange Server 2007.

1. Identifying users "Display Name" and "E-mail address" field

 (i). This is performed by Outlook client, basically a simple AD lookup. It comes into play when the user is logged on to the domain.

 (ii). It can be controlled by the DWORD ExchangeAddressDetect at  HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Preferences

2. Configuring the "basic" outlook profile

 (i). This is again done by the Outlook client, and known as the "Auto Account Setup" process. This phase configures Outlook profile , provided the user is logged onto the domain.

 (ii). Outlook client can be stopped from configuring the profile automatically by creating are DWORD value DisableAutoStartup at  HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\AutoDiscover

3. Configuring the additional features such as OOF, Availability, OAB and UM (if used)

 (i). Now the Autodiscover feature comes into play.

 (ii). Outlook client's role is limited to locating the autodiscover url (via SCP object or DNS depending on the situation).Once the URL is contacted, access to all other features depends on the settings configured.

Now, what happens if the mailbox is on Exchange Server 2003 and the user is using Outlook 2007 client? Will the outlook client configure the profile automatically? The answer is "Yes" (conditions apply). In that case only phases 1 and 2 come into picture, and the profile thus configured is a fully functional one.

Additional related information:

White Paper: Exchange 2007 Autodiscover Service

https://technet.microsoft.com/en-us/library/bb332063(EXCHG.80).aspx

Deploying additional registry values in the Office Customization Tool for Outlook 2007

https://technet.microsoft.com/en-us/library/cc837949.aspx

How Outlook 2007 works with different Exchange Server versions

https://technet.microsoft.com/en-us/library/cc178996.aspx