I'm trying to set up a dynamic distribution group in EMS.It should contain: Users with Exchange mailboxes, Users with external e-mail addresses, Contacts with external e-mail addressesIt should NOT contain: the OU named "Exclude" (i.e. the OU is DOMAIN/Exclude)So far, I have: Set-DynamicDistributionGroup AllWQ -RecipientFilter { ((RecipientType -eq 'MailboxUser') -and -not(...Any ideas?

On Tue, 9-Feb-10 22:39:28 GMT, jcws6 wrote:>I'm trying to set up a dynamic distribution group in EMS.It should contain: Users with Exchange mailboxes, Users with external e-mail addresses, Contacts with external e-mail addressesIt should NOT contain: the OU named "Exclude" (i.e. the OU is DOMAIN/Exclude)So far, I have: Set-DynamicDistributionGroup AllWQ -RecipientFilter { ((RecipientType -eq 'MailboxUser') -and -not(...Any ideas? You can't use an OU as one of your criteria. What you can do is topopulate a property on the mail-enabled objects in that OU with avalue and then check to see if that value is NOT in the property.---Rich MatheisenMCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

What if I put all of the "Exclude" users into a Security Group? How would I add that to my filter? And have I covered all of my "should contain criteria" (Users with Exchange mailboxes, Users with external e-mail addresses, Contacts with external e-mail addresses) in my test filter?I've never set a filter through EMS before - I usually use the GUI.

On Wed, 10-Feb-10 14:19:22 GMT, jcws6 wrote:>What if I put all of the "Exclude" users into a Security Group? How would I add that to my filter?I wish you could, but you can't.>And have I covered all of my "should contain criteria" (Users with Exchange mailboxes, Users with external e-mail addresses, Contacts with external e-mail addresses) in my test filter?I've never set a filter through EMS before - I usually use the GUI. You only look for mailboxuser in your filter but you say you wantusers and contacts with external addresses too, so I don't thinkyou'll be successful.---Rich MatheisenMCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

OK, any advice on how to set this up then?

On Mon, 15-Feb-10 19:22:02 GMT, jcws6 wrote:>OK, any advice on how to set this up then? Modify the RecipientFilter to include the types you're missing.http://technet.microsoft.com/en-us/library/bb738157(EXCHG.80).aspx---Rich MatheisenMCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

I should've prefaced this request by stating I don't know anything about Exchange filters. 1. What are the exact commands for the recipient types I'm missing? (Users with external e-mail addresses, Contacts with external e-mail addresses) 2. Do I have to exclude the users I don't want one at a time, or can I exclude a group? If I can exclude a group, what are the exact commands for excluding a group?I hope I've been specific enough. Surely, someone must know more about Exchange filters than I do.

On Tue, 16-Feb-10 14:20:43 GMT, jcws6 wrote:>>>I should've prefaced this request by stating I don't know anything about Exchange filters. 1. What are the exact commands for the recipient types I'm missing? (Users with external e-mail addresses, Contacts with external e-mail addresses) Did you visit the link in my previous reply? How about this one?http://technet.microsoft.com/en-us/library/bb124268(EXCHG.80).aspx>2. Do I have to exclude the users I don't want one at a time, or can I exclude a group?Membership in a group isn't a usable test in the recipientfilter.>If I can exclude a group, what are the exact commands for excluding a group?I hope I've been specific enough. Surely, someone must know more about Exchange filters than I do. ---Rich MatheisenMCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

Membership in a group isn't a usable test in the recipientfilter. It looks like that's not entirely accurate: http://blogs.technet.com/evand/archive/2007/02/13/using-memberof-with-recipientfilter.aspx

OK, so that MemberOfGroup thing looks too complicated, and it seems like it may or may not work in real life.So, here's my new idea: The domain only has 5 OUs, and one of them is hypothetically called Exclude, and I want to exclude the Exclude OU from a dynamic distribution group. I'm thinking of creating 4 DDGs, one per "good" OU, by using the -OrganizationalUnit command/filter. Then I'm going to put all Mail Contacts (i.e. RecipientType -eq 'MailContact') in a DDG. Finally, I'm going to put all 5 DDG groups into a regular Distribution Group. Theoretically, that should work, right?I'm probably going to test it anyway. I hate to be the guy who comes to the forum, asks for help, then solves his own problem - but it might end up that way. At least I'm learning more than I ever wanted to know about Exchange.

On Wed, 17-Feb-10 22:54:04 GMT, jcws6 wrote:>OK, so that MemberOfGroup thing looks too complicated, and it seems like it may or may not work in real life.So, here's my new idea: The domain only has 5 OUs, and one of them is hypothetically called Exclude, and I want to exclude the Exclude OU from a dynamic distribution group. I'm thinking of creating 4 DDGs, one per "good" OU, by using the -OrganizationalUnit command/filter. Then I'm going to put all Mail Contacts (i.e. RecipientType -eq 'MailContact') in a DDG. Finally, I'm going to put all 5 DDG groups into a regular Distribution Group. Theoretically, that should work, right?Adding DDGs to a mail-enabled DL? Yes, that will work.>I'm probably going to test it anyway. I hate to be the guy who comes to the forum, asks for help, then solves his own problem - but it might end up that way. You're just rethinking the problem using new (to you) information. Youhave a small number of OUs so the solution is managable. If youexpanded the number of OUs to be 500 instead of 5 the solution may notscale very well.Populating a common property with a value that allows you to select(or reject) AD objects scales no matter how many OUs (or users) youhave, expecially if the property is one that's indexed in the AD.>At least I'm learning more than I ever wanted to know about Exchange. ---Rich MatheisenMCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

All of this information is new to me, but I'm learning it on my own. And quickly.The problem with the common property thing is that there's a very real risk no one will remember it. If a new "Exclude" account is only created once every six months, it's plausible to believe that the step will get skipped, especially with administrators who don't like to refer to documentation. My new (to me) method eliminates that extra step.Also, it's never best practice to have hundreds of OUs. If I were implementing the solution over more than one domain, I'd imagine that would pose a problem, however.

I'm still having trouble with the filter.When I use -OrganizationalUnit "Exclude" <OR> -OrganizationalUnit "ou=Exclude,dc=mydomain,dc=com" in the filter, it creates a DDG in the Exclude group that contains all mailboxes in the domain. Same thing when I use -RecipientContainer. I checked the commands in TechNet (http://technet.microsoft.com/en-us/library/bb125127(EXCHG.80).aspx), and either command should work.I'm checking the filter by using:$Group = Get-DynamicDistributionGroup -Identity "DDGname"<THEN>Get-Recipient -Filter $Group.RecipientFilterIf I use Get-Mailbox -OrganizationalUnit "Exclude" , it lists all of the mailboxes in the Exclude OU, as it should. Any idea why the same command doesn't work in New-DynamicDistributionGroup ? I'm hoping this is just a stupid syntax problem, but I have no idea. Here's the exact command I'm using:New-DynamicDistributionGroup "Test" -RecipentFilter { (RecipientType -eq 'UserMailbox') } -RecipientContainer "Exclude"P.S. Same thing happens with New-DynamicDistributionGroup -Name "Test" -IncludedRecipients "MailboxUsers" -OrganizationalUnit "mydomain.com/Exclude"

On Mon, 22 Feb 2010 20:33:26 +0000, jcws6 wrote:>I'm still having trouble with the filter.When I use -OrganizationalUnit "Exclude" <OR> -OrganizationalUnit "ou=Exclude,dc=mydomain,dc=com" in the filter, it creates a DDG in the Exclude groupThe "-OrganizationalUnit" parameter says where to create the object,so there's no surprises there.>that contains all mailboxes in the domain. Unless you specified the -RecipientContainer value the DDG should onlylook in the OU where it was created. It shouldn't be searching theentire domain.>Same thing when I use -RecipientContainer.That's the starting point for the search.>I checked the commands in TechNet (http://technet.microsoft.com/en-us/library/bb125127(EXCHG.80).aspx), and either command should work.I'm checking the filter by using:$Group = Get-DynamicDistributionGroup -Identity "DDGname"<THEN>Get-Recipient -Filter $Group.RecipientFilter. If I use Get-Mailbox -OrganizationalUnit "Exclude" , it lists all of the mailboxes in the Exclude OU, as it should. Any idea why the same command doesn't work in New-DynamicDistributionGroup ? The -OrganizationalUnit parameter has a different purpose in the NEW-vs GET- cmdlets.>I'm hoping this is just a stupid syntax problem, but I have no idea. Here's the exact command I'm using:>New-DynamicDistributionGroup "Test" -RecipentFilter { (RecipientType -eq 'UserMailbox') } -RecipientContainer "Exclude"This should give you a DDL (created in the "Users" container) that canbe used to send e-mail to all the mailboxes in the "Exclude" OU:New-DynamicDistributionGroup -Name 'XXXXX' -IncludedRecipients'MailboxUsers' -OrganizationalUnit 'mydomain.com/Users' -Alias 'XXXXX'-RecipientContainer 'mydomain.com/Exclude'You can use the "ou=exclude,dc=mydomain,dc=com" in the-RecipientContainer, too.>P.S. Same thing>happens with >New-DynamicDistributionGroup -Name "Test" -IncludedRecipients "MailboxUsers" -OrganizationalUnit "mydomain.com/Exclude" That would create a DDL in the "Exclude" OU that can be used to e-mailall the mailboxes in the "Exclude" OU. The implicit base of the searchis the OU in which the DDG was created.---Rich MatheisenMCSE+I, Exchange MVP--- Rich Matheisen MCSE+I, Exchange MVP

This should give you a DDL (created in the "Users" container) that canbe used to send e-mail to all the mailboxes in the "Exclude" OU:New-DynamicDistributionGroup -Name 'XXXXX' -IncludedRecipients'MailboxUsers' -OrganizationalUnit 'mydomain.com/Users' -Alias 'XXXXX'-RecipientContainer 'mydomain.com/Exclude' I created a filter with that exact command. For some strange reason, it still displays every user mailbox in the domain. I'm pretty sure the command(s) I'm using to check the filter is the problem.If anyone has a better way to check the recipients of a DDG created in EMS, I'd be happy to try it out.

On Tue, 23 Feb 2010 22:49:37 +0000, jcws6 wrote:>This should give you a DDL (created in the "Users" container) that canbe used to send e-mail to all the mailboxes in the "Exclude" OU:New-DynamicDistributionGroup -Name 'XXXXX' -IncludedRecipients'MailboxUsers' -OrganizationalUnit 'mydomain.com/Users' -Alias 'XXXXX'-RecipientContainer 'mydomain.com/Exclude'I created a filter with that exact command. For some strange reason, it still displays every user mailbox in the domain. I'm pretty sure the command(s) I'm using to check the filter is the problem.If anyone has a better way to check the recipients of a DDG created in EMS, I'd be happy to try it out. Use the EMC. Display the property page of the DDG and select the"Conditions" tab. Click the "Preview" button.If you're going to use Powershell to do the same thing you'll have tospecify the base for the search. Failing to do that will cause thesearch to include the entire directory:$Group = Get-DynamicDistributionGroup -Identity "DDGname"Get-Recipient -Filter $Group.RecipientFilter -OrganizationalUnit$Group.RecipientContainer---Rich MatheisenMCSE+I, Exchange MVP--- Rich Matheisen MCSE+I, Exchange MVP

Use the EMC. Display the property page of the DDG and select the"Conditions" tab. Click the "Preview" button. The Preview button is grayed out for groups created in the shell, and the command listed didn't display a user list. Thanks for trying, though.At this point, I'll probably just create the groups in the Management Console. Which brings me right back to where I was at the beginning of this thread, but with an idea of how to do it and an unnecessary self-learning process that I hope will be useful sometime in the future.I discovered that there are some accounts outside of the "Exclude" OU that shouldn't be in the DDG. I guess I'll have to create a separate filter in EMS to exclude those specific mailboxes. Man, you'd think there would be an easier way to do this.

On Wed, 24 Feb 2010 16:47:12 +0000, jcws6 wrote:>Use the EMC. Display the property page of the DDG and select the"Conditions" tab. Click the "Preview" button.The Preview button is grayed out for groups created in the shell,Then use the EMC to create the DDG. Your query is pretty simple.>and the command listed didn't display a user list.It does when I create a group using your parameters and run it throughthat little bit of code. Perhaps it doesn't produce a list ofpotential members because the DDG is using incorrect information?Verify that the OPATH filter and recipient container are correct: $group | fl recipientfilter,recipientcontainer>Thanks for trying, though.At this point I'd have to conclude that there's some sort ofdisconnect between what you're posting here and what you're doingthere.>At this point, I'll probably just create the groups in the Management Console.If you have a simple set of criteria, I'd concur.>Which brings me right back to where I was at the beginning of this thread, but with an idea of how to do it and an unnecessary self-learning process that I hope will be useful sometime in the future.Since a good deal of what needs doing can't be done in the EMC I'd saythat "unnecessary" isn't true.>I discovered that there are some accounts outside of the "Exclude" OU that shouldn't be in the DDG. I guess I'll have to create a separate filter in EMS to exclude those specific mailboxes. Man, you'd think there would be an easier way to do this. There is. I proposed it at the beginning -- populate a property with aunique value and use that as the selection criterion. You can scriptthe process of populating that property and run it as a scheduledtask.---Rich MatheisenMCSE+I, Exchange MVP--- Rich Matheisen MCSE+I, Exchange MVP

At this point I'd have to conclude that there's some sort ofdisconnect between what you're posting here and what you're doingthere. Nope, no disconnect. I typed the commands exactly as listed, while substituting my group name. I'd attach some screenshots, but it's unnecessary at this point. The property thing is OK, but I can assure you, it will never be used again in this company (for new accounts). The best way to do what I need to do is the method I figured out, which can all be done in EMC. I'd suggest recommending that solution in the future.

The working solution: 1. Create a Dynamic Distribution Group in Exchange Management Console (recipient container in Filter Settings) for all top-level OUs except the one(s) to exclude from the mailing list. 2. Create a Distribution Group in Exchange Management Console containing all of the DDGs created in Step 1. 3. Move all other accounts you don't want in the list into the excluded OU(s) from Step 1.Again, thanks for trying.