Syncing Active Directory Groups for Unity Distribution Groups

We have multiple remote stores with managers that move around quite a bit. This poses an administration nightmare when trying to keep voicemail distribution lists up to date. Is there a way to syncronize an active directory group to a Unity voicemail distribution group? Therefore when we move a manager around in ADS the user automatically moves in Unity.

Unfortunately this feature has not been re-implemented in Unity Connection. This is one of the few things from Unity that I miss. I suggest voicing your desire for this as a feature enhancement with your Cisco AM.
If you are doing that many changes you may want to consider going through the Cisco Unity Connection Provisioning Interface. At least you could script the changes there using code that checked AD group membership and replicated the changes into CUC.

Similar Messages

Using Active Directory - either Secure or Distribution Groups

Reviewing the security documentation for UCM 10g R3, it appears that we should only map to Active Directory Secure Groups and not Distribution Groups, perhaps even if they are marked "secure"? Does anyone know if this is a technical limitation or a best practice? Our organization has processes in place to prevent ad-hoc updates to Distribution lists and I'd like to map UCM using this group type in AD because SQL statements can keep the membership list current in a Distribution Group.

dll is not a good candidate for the Agent, this has to be an application(exe), and the server onces it identifies the PCs should push this Agent to those PCs and the Application should have the logic to Phone home etc...

Powershell script to Scan Active Directory Attributes for Country and Department ,Then add to Sales Group then add to Distribution list based on Region

Hey Scripting Guys,
I have been in and out of Powershell last few years, not that great at it tbh !!! I'm looking for advice on how I can as in Title, Create a Powershell script to Scan Active Directory Attributes for Country and Department ,Then add to Group then add to Distribution
list based on Region/Country
I was thinking along the lines of get-aduser -LDAPFilter "(department=SALES France) and adding a where clause for country.
Any help would be great.
Dec

So I have tried a few variations but get errors on both
get-aduser -LDAPFilter "(&(department=SALES)(c=us))" | Add-ADPrincipalGroupMembership -MemberOf "testgroup"
get-aduser -LDAPFilter "(&(department=SALES)(c=fr))" | Add-ADGroupMember -identity "testgroup"
Add-ADPrincipalGroupMembership : Object reference not set to an instance of an
object.
At line:1 char:86
+ get-aduser -LDAPFilter "(&(department=SALES)(c=fr))" | Add-ADPrincipalGroupMe
mbership <<<< -MemberOf "testgroup"
+ CategoryInfo : NotSpecified: (:) [Add-ADPrincipalGroupMembershi
p], NullReferenceException
+ FullyQualifiedErrorId : Object reference not set to an instance of an ob
ject.,Microsoft.ActiveDirectory.Management.Commands.AddADPrincipalGroupMem
bership

Using -like operator to select recipients for Dynamic Distribution Group

Dear Scriptor,
I got few thousand of data and would like to select recipient according to the CustomAttribute1.
Below is the sample data in my database.
Name: User1, CustomAttribute1: aa, bb, cc
Name: User2, CustomAttribute1: aa, bb
Name: User3, CustomAttribute1: bb, cc, dd
If I run the script as below,
New-DynamicDistributionGroup -name "myDyna.bb" -RecipientFilter {(CustomAttribute1 -like 'aa*')}
The return result is User1 and User2
When I run the script as below,
New-DynamicDistributionGroup -name "myDyna.bb" -RecipientFilter {(CustomAttribute1 -like 'bb*')}
No result returned
How can I overcome this issue?
Thanks.

Below are my sample data in O365.
Type
Identity
UserPrincipalName
DisplayName
FirstName
LastName
CustomAttribute1
Mailbox
77771111
[email protected]
7777 #1
7777
#1
a1, a2, a3
Mailbox
77772222
[email protected]
7777 #2
7777
#2
a1, a2
Mailbox
77773333
[email protected]
7777 #3
7777
#3
d4, a1
Mailbox
77774444
[email protected]
7777 #4
7777
#4
a2, e5, f6
Mailbox
77775555
[email protected]
7777 #5
7777
#5
g7, h8, i9
Mailbox
77776666
[email protected]
7777 #6
7777
#6
g8, i9, a3
I would like to create a DynamicDistributionList where CustomAttibute1 contain "a2".
The expecting result are 77771111, 77772222 and 77774444.
How can I write the script?
I am using Windows Azure Active Directory Module for Windows Powershell. I run the $PSVersionTable.PSVersion and it returned me Major=4, Minor=0, Build=-1, and Revision=-1.
This works for you case:
New-DynamicDistributionGroup -name "myDyna.bb" -RecipientFilter {CustomAttribute1 -like '*a2*'}
Do not use parens "()".
¯\_(ツ)_/¯

Pre-populate adapter for setting the Active Directory OU for a user

Hi All
I created a pre-populate adapter that set the Active Directory OU for a user...
In the end the status of the resource is still showing "provisioning"..
It must be "Provsioned"..did I miss something ?
The logs speak as below :-
08:01:12,678 INFO [STDOUT] Running Create User
08:01:12,678 INFO [STDOUT] Before appending Root Context:OU=Human Resources,
08:01:12,678 INFO [STDOUT] tcUtilLDAPController.java : hierString : OU=Human Resources,dc=mydomain,dc=com
08:01:13,553 ERROR [ACTIVEDIRECTORYCONTROLLER] Problem creating object: javax.naming.OperationNotSupportedException: [LD
AP: error code 53 - 0000001F: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0
]; remaining name 'cn=ASYMONDS'
08:03:18,756 INFO [[xlWebApp]] action: LogonAction: User 'XELSYSADM' logged on in session 8116CBC0FA1481D06A207A1941B9
E096
08:22:31,256 ERROR [WEBAPP] Class/Method: ProvisionedResourcesForUserAction/confirmEnableSelection encounter some proble
ms: No checkbox was checked.

Just verify the OU value is correctly populated , first try doing the provisioning by manually giving OU and everything .
Is it successful ?
Then we can check if something wrong going with pre pop.
Thanks
Suren

SBS 2008 - Microsoft Azure Active Directory Module for Windows PowerShell - is not supported by your version

Hi,
I was following the artigle (http://www.messageops.com/resources/office-365-documentation/ad-fs-with-office-365-step-by-step-guide/) but
when try to install the 'Office 365 PowerShell Module' shows a msg saying that 'windows azure active directory module for windows powershell is not supported by your version'.
And according to the blog (http://blogs.office.com/2014/04/15/synchronizing-your-directory-with-office-365-is-easy/) "DirSync can be
installed on an existing domain controller"
>>>> Any help is appreciated.
* Similar issue: http://www.adaxes.com/forum/post7398.html

Ok Vasil tks for reply, but this server is 64x. I dont get the point.
Microsoft Windows [Version 6.0.6002]
C:\Users\Administrator>set
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Administrator\AppData\Roaming
CLIENTNAME=ANJOTEC_NOTE01
CommonProgramFiles=C:\Program Files\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
COMPUTERNAME=COMPANYBR-SERVER
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\Administrator
lib=C:\Program Files\SQLXML 4.0\bin\
LOCALAPPDATA=C:\Users\Administrator\AppData\Local
LOGONSERVER=\\COMPANYBR-SERVER
NUMBER_OF_PROCESSORS=4
OS=Windows_NT
Path=C:\ProgramData\Oracle\Java\javapath;C:\Program Files\HP\NCU;C:\Windows\sys
em32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\
1.0\;C:\Program Files (x86)\Microsoft SQL Server\90\Tools\binn\;C:\Program File
(x86)\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\Microsoft SQL Serve
\90\DTS\Binn\;C:\Program Files\Microsoft SQL Server\90\Tools\binn\;C:\Program F
les (x86)\Microsoft SQL Server\90\DTS\Binn\;C:\Program Files (x86)\Microsoft SQ
Server\90\Tools\Binn\VSShell\Common7\IDE\;C:\Program Files (x86)\Microsoft Vis
al Studio 8\Common7\IDE\PrivateAssemblies\;C:\Program Files (x86)\ExchangeMapi\
C:\Program Files (x86)\Common Files\Roxio Shared\DLLShared\;C:\Program Files (x
6)\Common Files\Roxio Shared\DLLShared\;C:\Program Files (x86)\Common Files\Rox
o Shared\9.0\DLLShared\;C:\Program Files\Microsoft\Exchange Server\bin;C:\Progr
m Files\Microsoft\Exchange Server\Scripts
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE=AMD64
PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 30 Stepping 5, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=1e05
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
ProgramFiles(x86)=C:\Program Files (x86)
PROMPT=$P$G
PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
PUBLIC=C:\Users\Public
RoxioCentral=C:\Program Files (x86)\Common Files\Roxio Shared\9.0\Roxio Central
3\
SESSIONNAME=RDP-Tcp#0
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\Administrator\AppData\Local\Temp\2
TMP=C:\Users\Administrator\AppData\Local\Temp\2
USERDNSDOMAIN=COMPANYBR.LOCAL
USERDOMAIN=COMPANYBR
USERNAME=administrator
USERPROFILE=C:\Users\Administrator
windir=C:\Windows
C:\Users\Administrator>

Best practice for Active Directory User Templates regarding Distribution Lists

Hello All
I am looking to implement Active Directory User templates for each department in the company to make the process of creating user accounts for new employees easier. Currently when a user is created a current user's Active directory account is copied, but
this has led to problems with new employees being added to groups which they should not be a part of.
I have attempted to implement this in the past but ran into an issue regarding Distribution Lists. I would like to set up template users with all group memberships that are needed for the department, including distribution lists. Previously I set this up
but received complaints from users who would send e-mail to distribution lists the template accounts were members of.
When sending an e-mail to the distribution list with a member template user, users received an error because the template account does not have an e-mail address.
What is the best practice regarding template user accounts as it pertains to distribution lists? It seems like I will have to create a mailbox for each template user but I can't help but feel there is a better way to avoid this problem. If a mailbox is created
for each template user, it will prevent the error messages users were receiving, but messages will simply build up in these mailboxes. I could set a rule for each one that deletes messages, but again I feel like there is a better way which I haven't thought
of.
Has anyone come up with a better method of doing this?
Thank you

You can just add arbitrary email (not a mailbox) to all your templates and it should solve the problem with errors when sending emails to distribution lists.
If you want to further simplify your user creation process you can have a look at Adaxes (consider it's a third-party app). If you want to use templates, it gives you a slightly better way to do that (http://www.adaxes.com/tutorials_WebInterfaceCustomization_AllowUsingTemplatesForUserCreation.htm)
and it also can automatically perform tasks such as mailbox creation for newly created users (http://www.adaxes.com/tutorials_AutomatingDailyTasks_AutomateExchangeMailboxesCreationForNewUsers.htm).
Alternatively you can abandon templates at all and use customizable condition-based rules to automatically perform all the needed tasks on user creation such as OU allocation, group membership assignment, mailbox creation, home folder creation, etc. based on
the factors you predefine for them.

MS Active Directory as LDAP Server - Email & Group variables do not pickup values

Hello Experts
We have OBIEE 10.1.3.4.2 using MS Active Directory as LDAP Server. Init Block "Authentication" (4 variables setup - USER, DISPLAYNAME, EMAIL and GROUP) seems to work fine, but when you do a "Test" and supply userid and password , only USER and DISPLAYNAME showup. Email and Group variables are blank.
Please help . Thanks lot in advance.
Regards.

Hello Srini
Just USER and DISPLAYNAME variables get populated and I think they are coming from MSAD. However, the Email and Group membership information from MSAD does not flow back to OBIEE Server.
Regards

Defined Groups for Cisco Jabber Group Chat

I dont think it is possible based upon this document but wondering if anyone knew any secrets out there. Is it possible to create predefined groups in Jabber for Windows preferably as defined in Active Directory or on the client side? We want to have chat groups automatically created for Sales, Engineering, etc. so users dont have to add other chat recipients users manually and can reach any engineering team member without knowing who is actually part of the engineering team for example.
http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/Windows/9/JABW_BK_C56E95B6_00_feature-guide.html

Hi,
Jabber for Windows 9.7 supports Persistent Chat end user participation.
Our next Release, 10.5 will add Room Administration and Moderator features, including room creation.
Persistent Chat Rooms
Users in your organization can use persistent chat rooms to share ideas and information in a chat room. The chat rooms look like group chats, except that the chat rooms stay active even after participants leave the room. When participants come back to the room, they can scroll back to read the messages that they missed.
Participants can manage their chat rooms by browsing the existing rooms and joining open rooms, or being added to a room by an administrator. When they are in the chat rooms, participants can create mentions for other users, which notifies the mentioned user if they are a member of the room. They can also search chat rooms for particular keywords or senders by creating filters.
Administrator tasks include creating, configuring, and deleting chat rooms, and adding or removing users from chat rooms. In this release, chat room administration and moderation must be performed with a client that supports persistent chat room administration. Cisco Jabber for Windows will provide administrative capabilities in a future release.
Cisco Unified Communications Manager IM and Presence Version 10 is a software prerequisite for persistent chat rooms.
For end user information about persistent chat rooms, see the chapter on Chats in the Advanced Feature Guide.
For administrator information about enabling persistent chat rooms, see the Installation and Configuration Guide and the Server Setup Guide.
Link for the same:
http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/jabber/Windows/9_7/JABW_BK_CF8F083D_00_cisco-jabber-for-windows-97/JABW_BK_CF8F083D_00_cisco-jabber-for-windows-97_chapter_00.html
Regards,
Swathi

Lion Server 10.7.4 VPN service not using my Active Directory domain for authentication

I have Lion Server 10.7.4 setup on a Mac Mini and I have enabled the VPN service for both L2TP and PPTP. The Mac Mini is joined to my Windows Domain at a functional level of Server 2008 R2. I have set the authentication paths to point to my domain in Directory Utility.
What I would like to have happen is for my laptop to be able to VPN into my office network remotely using domain credentials and not local account credentials on the Mac Mini itself. This is a process I have done numerous times on Windows boxes, but for some reason the only way I can get the VPN to work on this instance of Lion Server 10.7.4 is by authenticating using local accounts only.
Does Lion Server 10.7.4 only authenticate VPN users based on it's local account schema? Or can it truly authenticate against an active directory domain?
Any suggestions or help is greatly appreciated. Thanks,

Hi g-pirtle,
Yes, I had already done that a few days ago. I was able to add the desired AD group to the allowed users/groups for the VPN service. Thats exactly what is so weird about this...it allows me to search for and add an AD user or group to the list of allowed users/groups, but then when I actually try to use a domain account to authenticate to the VPN is just gives me the "cannot authenticate" error. Very strange.
I wondered if for some reason Apple is only allowing local accounts to be authenticated against. Sounds crazy, but I cannot for the life of me get this to work. I also wondered if Kerberizing the server would help, but when I go to join a Kerberos realm in Open Directory inside of Server Admin, it just has no realm listed in the drop down menu.
Other than that, all other aspects of the Mac Mini being joined to the AD domain seems to be good. I'm really stumped here...
Thanks again,

Creating Active Directory Accounts for vSphere 5.1 Services

To set up the management pieces of vSphere, I need to have an account or accounts created in Active Directory. I need to determine how many to create and what permissions they need.
In Single Sign on Server, I need to choose an account that vCenter server will use when it connects to SSO. I can use the default admin@system-domain. Or I can add an account that is configured in Active Directory. Or, I can also use an active directory group instead of an individual user. What is the best way to do this and if I use an AD account, what permissions does it need at the domain level and at the local level on the Single Sign on Server? (I'm using multisite mode, so I can't use local accounts)
In SQL Server, I need to choose an account to use for the SQL server service. Should this account be an active directory account or a local user account? If so, what permissions should be assigned to the account in Active Directory and what permissions should be assigned to it on the local machine? What AD group, if any should it be a part of? What local permissions does it need?
In vCenter Server, I need to choose an account to run the "vCenter Server Service" in. Is it best to use the default "system" account or to use an account from Active Directory, or a local account?
I'm trying to get a big picture of an AD account/group strategy to use that covers the main management pieces of vSphere - vCenter Server, Single Sign on, Inventory Service, Web Client Services.
For example, create one group called "vSphere Services", then create separate accounts for each management piece, and assign them specific permissions on specific systems. Or create separate groups for each management piece and assign permissions to the groups. Is it better to consolidate some of these user names or split them out? Any experiences / suggestions welcome. Thanks.

Hello,
For general services I use a service specific account within AD. This was before SSO and I use the same after SSO. SSO is used by only two services that I know about at the moment (Inventory Service and perhaps vCloud). However, there are many other service accounts that should be created. You want one account per service and I use AD for this, this way I can create a service account group and give it the appropriate roles and privileges. FOr example I have service accounts for:
VMware View
XenDesktop
vCops
HPSIM
Solarwinds
VMTurbo
NetApp
etc.
One service, one service account, each with either a general role or custom role depending on access requirements to vCenter.
For SSO, I to am waiting on general information, but I set mine up fairly basically to cover only those resources that make use of SSO. Since the vast majority of items do not use SSO, the rule still applies. Once SSO is supported by more than one or two tools, you still need to maintain that separation.
So I say yes, tie SSO to AD and do everything in one place, unfortunately, that is not very clear, or at least was not to me and these SSO issues are either beng fixed, documented, or both.
Best regards,
Edward L. Haletky aka Texiwill

10.5.5 Active directory problem for mobile users

I an running 10.5.5 on a MBP 2.4. The computer is attached to Active Directory for authentication. The accounted is setup as a mobile user with automatic home sync. Below is the problem I'm experiencing after 10.5.5.
Upgrade worked fine, everything went through as expected. When I got home with computer, couldn't login. I did eventually get logged in, computer became extremely unresponsive at intermittent times.
At work next day, everything worked fine.
I believe this is a problem with 10.5.5 computers that are bound to AD, when AD is not available (but internet is.) Some type of weird priority locking or timeout setting? It seems to fail immediately if no network is available, but if the internet is available it is like it gets "hung" waiting for a response.
Anybody else having similar problems?
Below are the details on the specific tests that brought me to this conclusion.
1) Boot with work network cable connected - Works fine
2) Boot with work wifi network enabled - works fine
3) Boot with public wifi network enabled and work cable - works fine.
4) Boot with only public wifi - appears "frozen" (turned off after 5 minutes of trying to login)
5) Boot without network or wifi - works fine using cached mobile account info
6) Boot with network cable and public wifi, remove network cable after login- works fine for a period becomes periodically frozen. attempts to do anything become queued, when computer starts responding queue emptys out (can see menus / applications switch around to correspond with clicks.)
7) Change account to Manual sync of mobile account, again boot with network cable and public wifi, remove network cable- no freezing responds normaly.
All steps repeated after rebinding computer to AD - same results.

First rule of installing an upgrade, run permissions repair both before & after. Did you do that?
I'm using a Mac dual bound to AD & OD, works perfectly. I can't speak for the exact setup of your network but I personally would be suspicious of AD. I had a similar issue some time back where my processor would go crazy with the net directory authentication running like crazy. Turned out AD had somehow forgotten my computer. It only happened away from work where my Mac couldn't contact the AD server (not exactly sure why). I'd try the following.
1. While at work create a local administrative account on your Mac (you should always have a backup account anyway).
2. Login as local admin account.
3. open Directory Utility from the Applications/Utilities folder & remove the AD server (you'll need an account that can bind machines to AD).
4. re-add your Mac to AD.
This may resolve your issue & shouldn't hurt anything in the least.

Group ownership of Distribution Group not working

Hi,
We recently migrated from Exchange 2007 to 2013 CU2. We have various security groups with permissions to edit various distribution lists; this is no longer working. I've already researched the problem and I understand two things are necessary for a
user to have permission to edit a distribution list:
1. User must have membership in the My Distribution Groups and My Distro Groups Membership roles. Already done.
2. User must be an owner of the distribution group.
The problem comes with the ownership. I'm assigning ownership of the distribution list to a security group, of which my test user is a member. Per
this article, groups can own groups again as of 2013 CU1.
If I directly assign a user ownership of the group, they can edit membership without issue, which means item #1 is satisfied. But they are not receiving ownership by way of membership in the group that owns the distribution list. Or put another way, their
group membership is not granting them ownership of the group as it should.
Any thoughts? Spent a good hour searching and can't come up with anything.
Thanks,
James

Hi -
That is correct, and is a problem with dozens of existing distribution groups.
For testing purposes I just did the following:
1. Created a new distribution group "Test Distro Group"
2. Created a new mail-enabled security group "Test Distro Group Owners"
3. Ran Set-DistributionGroup -Identity "Test Distro Group" -ManagedBy "Test Distro Group Owners"
4. Confirmed ownership via the shell:
Get-DistributionGroup -Identity "Test Distro Group" | fl
GroupType                               : Universal
SamAccountName                       : Test Distro Group
BypassNestedModerationEnabled  : False
ManagedBy                                 : {contoso.com/Users/Test Distro Group Owners}
5. Confirmed ownership via ECP:
6. Added a test user "_Sample Teacher" to the "Test Distro Group Owners" group. Confirmed membership via ECP:
7. Logged into OWA as "_Sample Teacher," went to Options, then Groups. "Test Distro Group Owners" is shown as a group that the user belongs to, however no groups are shown under "distribution groups I own."
8. If I add "_Sample Teacher" directly as an owner of "Test Distro Group," the group appears as expected as an owned group.
So in short...the user is a member of the security group, the security group owns distribution group; the user should then be an owner of the distro group via membership in the security group, however this is not working.
Thanks for any help you can provide. I'm not sure where to go next.
James

Assign Group Permission to Distribution Group

I have a Distribution Group in AD and i want to assign permission to same in SharePoint. But i am not able to get that group in people picker. However, i am able to fetch the Security Group from AD to SharePoint.
Please advice.
If this helped you resolve your issue, please mark it Answered

Hi Avni,
Since you are posting the thread to SharePoint 2013 forum, so I assume you are using SharePoint 2013. Below is to help you understand Distribution group and Security group:
Security group A group that can be listed in DACLs. A security group can also be used as an e-mail entity.
Distribution group A group that is used only for e-mail distribution and that is not security-enabled. Distribution groups cannot be listed in discretionary access control lists (DACLs), which are used to define permissions
on resources and objects.
You can use security groups to control permissions for your site by adding security groups to SharePoint groups and granting permissions to the SharePoint groups.
You cannot add distribution groups to SharePoint groups, but you can expand a distribution group and add the individual members to a SharePoint group. If you use this method, you must manually keep the SharePoint group synchronized with the distribution
group.
If you use security groups, you do not need to manage the individual users in the SharePoint application. Because you included the security group instead of the individual members of the group, AD DS manages the users for you.
I'd recommend you using Security group for SharePoint related permission settings instead of Distribution group.
https://technet.microsoft.com/en-us/library/cc261972(v=office.15).aspx
Regards,
Rebecca Tu
TechNet Community Support

Exchange 2013, a distribution group within a distribution group is not receiving emails.

Here's the explanation of what's going on:
"A" is an internal distribution group containing other internal contacts, and internal distribution groups "B" and "C". "B" is a working distribution group that contains all internal contacts. "C" contains all
external contacts, who will successfully receive emails sent directly to "C". The problem is, when you send an email to "A", everyone in "B" receives the email, but no one in "C" does. "C" is set to receive
emails from external sources and has correct SMTP settings as far as I can tell.
Is this problem related to the fact that "C" is full of external contacts? Is there a setting I'm missing somewhere that will allow "C" to receive emails sent to "A"?
Edit: Group "C" can not receive emails at all.

Sorry, i meant does the mailbox you are sending the email FROM have permission to send emails TO external email address?
Our exchange server is set up so that certain people can only email internal addresses. This is configured in the ECP under Mail Flow - Rules, and is basically configured to state that anyone within the AD group "internal only" to reject the message and
provide the explanation "you are not allowed to email externally".
If the mailbox you are sending the mail from is not permitted to email external contacts, it wont work.
It can be tested by emailing one of the addresses in Group C individually.

Syncing Active Directory Groups for Unity Distribution Groups

Similar Messages

Maybe you are looking for