Exchange 2010 SP1 Distribution Group Membership Management

Posted on 2011-04-28
Last Modified: 2012-05-11
I am looking for a way to assign the right to modify distribution group membership, in Outlook through Exchange 2010, SP1 to a group, rather than an individual.

We have several hundred DLs which in E2K3 where configured to allowed membership modification by members of a group, which itself has a large number of members. I have not found a way in Exchange 2010 to recreate this configuration.

I tried running...

Set-DistributionGroup “GroupName” –Managedby “Security Group Name” – BypassSecurityGroupManagerCheck

….I get an error indicating that the owner of the group must have recipient type details that equal UserMailbox, LegacyMailbox, SharedMailbox, MailUser, LinkedMailbox, RemoteUser, RemoteSharedMailbox, MailContact, or User.

I tried running....

Add-ADPermission -Identity "DL Name" -User "Management Group Name" -AccessRights WriteProperty - Properties Member

....and got the following error...

Active Directory operation failed on "DomainControllerName". This error is not retriable. Additional information: Access i
s denied.
Active directory response: 00000005: SecErr: DSID-03151E07, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
    + CategoryInfo          : WriteError: (0:Int32) [Add-ADPermission], ADOperationException
    + FullyQualifiedErrorId : D0CDD1B8,Microsoft.Exchange.Management.RecipientTasks.AddADPermission

....I get this same error even if I specifiy an individual user rather than a management group.

Any help would be appreciated.
Question by:thar0817

    Author Comment

    I have discovered that if I go into ADSI Edit, find the distribution group which needs to be managed, and modify the attribute msExchCoManagedByLink to include the distinguished name of the management group – then the management group appears in EMC under Managers – but, it appears with a red X and under organizational unit it indicates “Object not found.”

    I assume this means that EMC is not searching for groups, and the permission will never become effective in Exchange.

    Am I just screwed here? I don’t know why Microsoft would implement a system in which you are forced to assign permissions to individuals rather than groups.
    LVL 37

    Accepted Solution


    You can't assign DG management to a group, only an individual user. I'm not sure why Microsoft would set this limitation and I agree it is frustrating. BTW, I would recommend against going into ADSI edit and making changes like you did. If you can't set something through the GUI or powershell, you shouldn't try to circumvent the restrictions by editing the object directly. This has the potential to cause major problems.


    Author Comment

    Thanks. Thats really all I was looking for - someone to confirm what the situation seemed to be. So, I'll take that as an answer.

    Agree about ADSI Edit. I wouldn't normally do that. I just modified a test object to try and prove what I thought was going on there......Interestingly, and this is completely unrelated, I have found a few instances in which I had to make a change in ADSI Edit in order to successfully complete a mailbox move to Exchange 2010. On almost all of our user accounts the userPrincipleName attribute is There are a handfull for which it is only the user name. I had to add the in order for the mailbox move to complete successfully. Otherwise I got an error about invalid data. Everything in the GUI seemed consistent and I found no other solution.....Just interesting, but not realted to this case.

    Thanks again for your time.

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    Join & Write a Comment

    Use these top 10 tips to master the art of email signature design. Create an email signature design that will easily wow recipients, promote your brand and highlight your professionalism.
    In this video we show how to create a Contact in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Contact ta…
    In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now