As an Exchange administrator, you'll find that you need
to perform many additional group management tasks. These essential
tasks are discussed in this section.
Changing a Group's Name Information
Each mail-enabled group has a display name, an Exchange alias, and
one or more e-mail addresses associated with it. The display name is
the name that appears in address lists. The Exchange alias is used to
set the e-mail addresses associated with the group.
Whenever you change a group's naming information, new e-mail
addresses can be generated and set as the default addresses for SMTP.
These e-mail addresses are used as alternatives to e-mail addresses
previously assigned to the group.
To change the group's Exchange name details, complete the following steps:
-
In the Exchange Management Console, double-click the group entry. This opens the group's Properties dialog box. -
On the General tab, the first text box shows the display name of the group. If necessary, type a new display name. -
The Alias text box shows the Exchange alias. If necessary, type a new alias. Click OK.
Note
When you change a group's display name, you give the group a new
label. Changing the display name doesn't affect the SID, which is used
to identify, track, and handle permissions independently from group names.
Changing, Adding, or Deleting a Group's E-Mail Addresses
When you create a mail-enabled group, default e-mail addresses are
created for SMTP. Any time you update the group's Exchange alias, new
default e-mail addresses can be created. The old addresses aren't
deleted, however; they remain as alternative e-mail addresses for the
group.
To change, add, or delete a group's e-mail addresses, follow these steps:
-
In the Exchange Management Console, double-click the group entry. This opens the group's Properties dialog box. -
On the E-Mail Addresses tab, you can use the following techniques to manage the group's e-mail addresses:
-
Create a new SMTP address Click the arrow to the right of Add, and then select SMTP Address. Enter the e-mail address, and then click OK. -
Create a custom address
Click the arrow to the right of Add, and then select Custom Address.
Enter the e-mail address, and then enter the e-mail address type. Click
OK.
Tip
Use SMTP as the address type for standard Internet e-mail addresses.
For custom address types, such as X.400, you must manually enter the
address in the proper format.
-
Set a new Reply To address Select the address you want to be the new default, and then click Set As Reply. -
Edit an existing address Double-click the address entry. Modify the settings in the Address dialog box, and then click OK. -
Delete an existing address Select the address, and then click the Remove button.
Hiding Groups from Exchange Address Lists
By default, any mail-enabled security group or other distribution group that you create is shown in Exchange address lists, such as the global address list. If you want to hide a group from the address lists, follow these steps:
-
In the Exchange Management Console, double-click the group entry. This opens the group's Properties dialog box. -
On the Advanced tab, select the Hide Group From Exchange Address Lists check box. Click OK.
Note
When you hide a group, it isn't listed in Exchange address lists.
However, if a user knows the name of a group, he or she can still use
it in the mail client. To prevent users from sending to a group, you
must set message restrictions, as discussed in the next section,
"Setting Usage Restrictions on Groups."
Tip
Hiding group
membership is different from hiding the group itself. In Outlook, users
can view the membership of groups. In Exchange Server 2010, you cannot
prevent viewing the group membership. In addition, membership of
dynamic distribution groups is not displayed in global address lists
because it is generated only when mail is sent to the group.
Setting Usage Restrictions on Groups
Groups are great resources for users in an organization. They let
users send mail quickly and easily to other users in their department,
business unit, or office. However, if you aren't careful, people
outside the organization can use groups as well. Would your boss like
it if spammers sent unsolicited e-mail messages to company employees
through your distribution lists? Probably not—and you'd probably be
sitting in the hot seat, which would be uncomfortable, to say the least.
To prevent unauthorized use of mail-enabled groups, you can specify
that only certain users or members of a particular group can send
messages to the group. For example, if you create a group called
AllEmployees, of which all company employees were members, you can
specify that only the members of AllEmployees can send messages to the
group. You do this by specifying that only messages from members of
AllEmployees are acceptable.
To prevent mass spamming of other groups, you can set the same
restriction. For example, if you have a group called Technology, you
can specify that only members of AllEmployees can send messages to that
group.
Note
If you have users
who telecommute or send e-mail from home using a personal account, you
might be wondering how these users can send mail after you put a
restriction in place. What I've done in the past is create a group
called OffsiteEmailUsers
and then added this as a group that can send mail to my mail-enabled
groups. The OffsiteEmailUsers group contains separate mail-enabled
contacts for each authorized off-site
e-mail address. Alternatively, users could simply log on to Outlook
Anywhere, Outlook Web App, or Exchange ActiveSync and send mail to the
group; this is an approach that doesn't require any special groups with
permissions to be created or maintained.
Another way to prevent unauthorized use of mail-enabled groups is to
specify that only mail from authenticated users is accepted. An
authenticated user is any user accessing the system through a logon
process. It does not include anonymous users or guests, and it is not
used to assign permissions. If you use this option, keep in mind that
off-site users will need to log on to Exchange before they can send mail to restricted groups, which might present a problem for users who are at home or on the road.
You can set or remove usage restrictions by completing the following steps:
-
In the Exchange Management Console, double-click the group entry. This opens the group's Properties dialog box. -
On the Mail Flow Settings tab, double-click Message Delivery Restrictions. -
If you want to ensure that messages are accepted only from
authenticated users, select the Require That All Senders Are
Authenticated check box. -
To accept messages from all e-mail addresses except those on the reject list, under Accept Messages From, select All Senders. -
To specify that only messages from the listed users, contacts, or
groups be accepted, under Accept Messages From, select the Only Senders
In The Following List option, and then add acceptable recipients:
-
Click Add to display the Select Recipient dialog box. -
Select a recipient, and then click OK. Repeat as necessary.
Tip
You can select multiple recipients at the same time. To select
multiple recipients individually, hold down the Ctrl key and then click
each recipient that you want to select. To select a sequence of
recipients, select the first recipient, hold down the Shift key, and
then click the last recipient.
-
To specify that no recipients should be rejected, under Reject Messages From, select No Senders. -
To reject messages from specific recipients, under Reject Messages
From, select Senders In The Following List, and then add unacceptable
recipients:
-
Click Add to display the Select Recipient dialog box. -
Select a recipient, and then click OK. Repeat as necessary.
-
Click OK.
Setting Message Size Restrictions for Delivery to Groups
By default, messages of any size can be sent to distribution groups.
You can change this behavior by limiting the size of messages that
users can send to distribution groups. To do this, complete the
following steps:
-
Open the Properties dialog box for the group by double-clicking the group name in the Exchange Management Console. -
On the Mail Flow Settings tab, double-click Message Size Restrictions. -
Select the Maximum Message Size (In KB) check box. -
In the text box provided, enter the maximum message size in
kilobytes (KB). Be sure to set a size that allows the sending of
suitably sized attachments. Click OK twice.
If a message addressed to the group exceeds the limit, the message
isn't distributed to members of the group, and the user receives a
nondelivery report (NDR).
Setting Out-of-Office and Delivery Report Options for Groups
By default, distribution groups are configured so that delivery
reports are sent to the person who sent the mail message. You can
change this so that delivery reports are sent to the group owner or not
sent at all. You can also specify out-of-office messages that are returned in response to messages from the sender. To set these options, complete the following steps:
-
Open the Properties dialog box for the group by double-clicking the group name in the Exchange Management Console. -
On the Advanced tab, if you want out-of-office messages to be delivered to the sender, select the Send Out-Of-Office Message To Originator check box. -
If you want to stop sending delivery reports, select Do Not Send
Delivery Reports. Alternately, you can send delivery reports to the
group manager or the message originator. Click OK.
Deleting a group removes it permanently. After you delete a group,
you can't create a group with the same name and automatically restore
the permissions that the original group was assigned because the SID
for the new group won't match the SID for the old group. You can reuse
group names, but remember that you'll have to re-create all permissions
settings.
Windows doesn't let you delete built-in groups. In the Exchange
Management Console, you can remove other types of groups by
right-clicking them and selecting Remove. When prompted, click Yes to
delete the group. If you click No, the Exchange Management Console will
not delete the group.
In the Exchange Management Shell, only a group's manager or other authorized user can remove a group. You can use the Remove-DistributionGroup cmdlet to remove distribution groups, as shown in Example 1.
Example 1. Remove-DistributionGroup cmdlet syntax and usage
Syntax
Remove-DistributionGroup -Identity GroupIdentity
[-BypassSecurityGroupManagerCheck {$true | $false}]
[-DomainController FullyQualifiedName]
[-ExternalManaged {$true | $false}]
[-IgnoreDefaultScope {$true | $false}]
Usage
Remove-DistributionGroup -Identity 'cpandl.com/Users/AllSales'
To remove dynamic distribution groups, you can use the Remove-DynamicDistributionGroup cmdlet. Example 2 shows the syntax and usage.
Example 2. Remove-DynamicDistributionGroup cmdlet syntax and usage
Syntax
Remove-DynamicDistributionGroup -Identity GroupIdentity
[-DomainController FullyQualifiedName]
[-IgnoreDefaultScope {$true | $false}]
Usage
Remove-DynamicDistributionGroup -Identity 'cpandl.com/Users/CrossSales'
|
