Preventing users from mailing specific groups
Ok, its been a while since I posted
a SNTT, and I was asked this recently, so figured it may be a useful tip
for an admin newbie. So imagine you are an administrator, and have
to (only ever now and then) deal with pesky end user requests. Well,
there is a request to prevent any old user from mailing the group that
contains all the users in the domain (or any group for that matter). Its
a fairly simple process.
So you have a group that contains all
the users in your domain. Here it is:
(em… obviously it would contain users
in the real world – in my domain, I don’t allow users).
Now, create a group that would contain
all the users that will be allowed to mail to the group above. And
here you go:
Add all your permitted users to that
group. Now go back to the group with all the users in it and go into
the document properties. Click on the key (security) tab and you
will see the following:
Uncheck the ALL READERS AND ABOVE checkbox
and then we are going to click on the torso icon to the right, and choose
which users can read this group from the directory.
I have added in the group that will
contain the users permitted to mail to this group, and the admins and localdomainservers
group for management purposes.
Thats pretty much it – now only users
in that group (and admins) can mail to the contents of that large group.
If you want to permit / deny rights, just add/remove users from the
group.
Mike Kinder Said,
November 9, 2007 @ 10:45 pm
@4 – True Duffbert (love the screen name BTW), I just wanted to let you know of the caveat. There is an alternative that I have used in the past that eliminates this trouble. It is more difficult to setup the first time, but using it has some added benefits. In a nutshell (feel free to email me if you want more details) you set the “group” up as a Mail in database. Then have an agent in the mail-in db check every message that comes in to determine if the sender has a right to send to this group. If not, flag it and be done with it. If so, forward the info, but as a doc link back to the database. This allows for better controls all around, message sizes, message recall, etc. What this mail-in db sends to is the reader restricted group, with two changes. The group is not a group that can be mailed to (i.e. ACL Only group). And, you don’t mail to the group name but the members in the group as BCC members only so no one knows about the group or its name. There is a little more to it -maybe a good OpenNTF project?
Mike Kinder Said,
November 9, 2007 @ 10:45 pm
Hey, one word of warning using this method though. If a user who is not allowed to use the group is a member of the group and they use the “Reply to All” option they will get an error when sending. The error says something about cannot see the group, choose OK to skip or cancel to stop. Choosing OK removes the group and does not send to it – but the error may create just as many help desk calls. There are alternatives, each of which has some drawbacks though.
Duffbert Said,
November 9, 2007 @ 10:45 pm
@2… I’m more than willing to admit there’s the odd nugget of truth that an admin might possess that could have bypassed me (or been forgotten over time). It’s rare, but possible…
@3… It seems like that would be a problem with just about any approach that restricted use of distro groups. But I think I’d rather live with the odd call than have someone do an all-company “burn the bridges” email on their way out the door… :)
Duffbert Said,
November 9, 2007 @ 10:45 pm
SWEET! I have a service request at work asking for just this type of restriction, and I hadn’t been able to do much to resolve it. My solution would have been MUCH more convoluted than this.
Thanks, Paul, and I owe you big time.
Rob Novak Said,
November 9, 2007 @ 10:45 pm
Just curious, does this prevent routing the mail if the group is spelled correctly (desired), or does it just prevent the user without access to the document from seeing the group name?
Paul Mooney Said,
November 9, 2007 @ 10:45 pm
@8 – Yep – even if you know the group name, it wont work
@7 – Excellent! Happy to test/help out
@9 – Cool! Thanks Jess
Paul Mooney Said,
November 9, 2007 @ 10:45 pm
Hi Mike – I have used that method too, but as a quick fix goes, the method above works fine
Mike Kinder Said,
November 9, 2007 @ 10:45 pm
@6 I agree Paul. Again, just wanted to mention the potential issue and an alternative solution. As an aid in this effort, look for an OpenNTF project very soon that will facilitate the other process quite easily. I made some good progress on it last night. I’ve been meaning to do it for quite sometime anyway. I will update this post when I am done.
mkinder@acadiasolutions.com
francie Said,
November 9, 2007 @ 10:45 pm
WHAAAAT?
A developer admitted to learning something from an Admin????
Jess Stratton Said,
November 9, 2007 @ 10:45 pm
Awesome tip, Paul, Thanks! I’m posting this on the LUG blog now.