« Exchange Blackberry help needed | Main| A lepoard arrived today »

Preventing users from mailing specific groups

Category

Ok, its been a while since I posted a SNTT, and I was asked this recently, so figured it may be a useful tip for an admin newbie.  So imagine you are an administrator, and have to (only ever now and then) deal with pesky end user requests.  Well, there is a request to prevent any old user from mailing the group that contains all the users in the domain (or any group for that matter).  Its a fairly simple process.  

So you have a group that contains all the users in your domain.  Here it is:
A picture named M2
(em... obviously it would contain users in the real world - in my domain, I don't allow users).

Now, create a group that would contain all the users that will be allowed to mail to the group above.  And here you go:

A picture named M3
Add all your permitted users to that group.  Now go back to the group with all the users in it and go into the document properties.  Click on the key (security) tab and you will see the following:
A picture named M4

Uncheck the ALL READERS AND ABOVE checkbox and then we are going to click on the torso icon to the right, and choose which users can read this group from the directory.
A picture named M5
I have added in the group that will contain the users permitted to mail to this group, and the admins and localdomainservers group for management purposes.

Thats pretty much it - now only users in that group (and admins) can mail to the contents of that large group.  If you want to permit / deny rights, just add/remove users from the group.

Posted by Paul Mooney On 30/10/2007 | Digg This |

Comments

1 - SWEET! I have a service request at work asking for just this type of restriction, and I hadn't been able to do much to resolve it. My solution would have been MUCH more convoluted than this.

Thanks, Paul, and I owe you big time.

Posted by Duffbert At 22:45:38 On 09/11/2007 | - Website - |


2 - Hi Mike - I have used that method too, but as a quick fix goes, the method above works fine

Posted by Paul Mooney At 22:45:38 On 09/11/2007 | - Website - |


3 - WHAAAAT?
A developer admitted to learning something from an Admin????
Emoticon

Posted by francie At 22:45:38 On 09/11/2007 | - Website - |


4 - Awesome tip, Paul, Thanks! I'm posting this on the LUG blog now.

Posted by Jess Stratton At 22:45:38 On 09/11/2007 | - Website - |


5 - Just curious, does this prevent routing the mail if the group is spelled correctly (desired), or does it just prevent the user without access to the document from seeing the group name?

Posted by Rob Novak At 22:45:38 On 09/11/2007 | - Website - |


6 - @8 - Yep - even if you know the group name, it wont work

@7 - Excellent! Happy to test/help out

@9 - Cool! Thanks Jess

Posted by Paul Mooney At 22:45:38 On 09/11/2007 | - Website - |


7 - @6 I agree Paul. Again, just wanted to mention the potential issue and an alternative solution. As an aid in this effort, look for an OpenNTF project very soon that will facilitate the other process quite easily. I made some good progress on it last night. I've been meaning to do it for quite sometime anyway. I will update this post when I am done.
mkinder@acadiasolutions.com

Posted by Mike Kinder At 22:45:38 On 09/11/2007 | - Website - |


8 - @2... I'm more than willing to admit there's the odd nugget of truth that an admin might possess that could have bypassed me (or been forgotten over time). It's rare, but possible...

@3... It seems like that would be a problem with just about any approach that restricted use of distro groups. But I think I'd rather live with the odd call than have someone do an all-company "burn the bridges" email on their way out the door... :)

Posted by Duffbert At 22:45:38 On 09/11/2007 | - Website - |


9 - Hey, one word of warning using this method though. If a user who is not allowed to use the group is a member of the group and they use the "Reply to All" option they will get an error when sending. The error says something about cannot see the group, choose OK to skip or cancel to stop. Choosing OK removes the group and does not send to it - but the error may create just as many help desk calls. There are alternatives, each of which has some drawbacks though.

Posted by Mike Kinder At 22:45:38 On 09/11/2007 | - Website - |


10 - @4 - True Duffbert (love the screen name BTW), I just wanted to let you know of the caveat. There is an alternative that I have used in the past that eliminates this trouble. It is more difficult to setup the first time, but using it has some added benefits. In a nutshell (feel free to email me if you want more details) you set the "group" up as a Mail in database. Then have an agent in the mail-in db check every message that comes in to determine if the sender has a right to send to this group. If not, flag it and be done with it. If so, forward the info, but as a doc link back to the database. This allows for better controls all around, message sizes, message recall, etc. What this mail-in db sends to is the reader restricted group, with two changes. The group is not a group that can be mailed to (i.e. ACL Only group). And, you don't mail to the group name but the members in the group as BCC members only so no one knows about the group or its name. There is a little more to it -maybe a good OpenNTF project?

Posted by Mike Kinder At 22:45:38 On 09/11/2007 | - Website - |