CUP 5.3 SP8 - Distribution Groups and DL Approver

Hello,
In CUP, we are trying to configure the DL Approver because we are using a Distribution List as the alternate approver for one of our stages (At Stage Role Approver)
We are testing a change request for a user to get a role which has the role approver TCUPRA1. The Alternate approver for this role is DL-TESTCUP. Tied to this DL in active Directory is TCUPRA2 and TCUPRA3.
All 3 of these approvers are in our SAPHR system, which is what we use for authentication, data source, and search source. All 3 of these users also have the necessary LAN accounts to properly tie them to the DL. Our LDAP connector in CUP is configured correctly and works great and we have setup Approver group using the distribution list DL-TESTCUP.
In our test workflow, we have escalation setup that if a Role Approver doesn't approve within an hour, the request is forwarded to alternate approver. In this case, the alternate approver is DL-TESTCUP (so in theory, since TCUPRA2 and TCUPRA3 are tied to this DL, they should be the alternate approvers i.e. have authority to move the request along)
At the stage right before Role Approver stage (which is the stage where we are adding this role to the request), we are getting an error that says " Error processing your request, Request no: 32 in stage : BR_SEC_ASSIGN."
Here is the error in logs:
Caused by:
com.sap.security.core.logon.imp.UMELoginException: USER_AUTH_FAILED
     at com.sap.security.core.logon.imp.SAPJ2EEAuthenticator.logon(SAPJ2EEAuthenticator.java:946)
     at com.virsa.ae.service.umi.ume.UMEAuthenticator.authenticate(UMEAuthenticator.java:104)
     ... 19 more
2009-07-31 10:16:39,178 [SAPEngine_Application_Thread[impl:3]_25] ERROR  Ignoring Exception - User : BRAZIL SEC ADMINS  not found to get full name
com.virsa.ae.core.ObjectNotFoundException: User BRAZIL SEC ADMINS not found in SAP HR system
I'm seeing in there that User BRAZIL SEC ADMINS is not found in HR? BRAZIL SEC ADMINS is not a user, but rather the name of the Distribution Group we defined in CUP. Maybe I'm misunderstand the whole functionality of DL approvers in CUP?
Can someone clarify to me how I setup this piece of functionality - what are we doing wrong? Why is CUP looking in HR to authenticate a Group name that I defined IN CUP?
Let know if I need to elaborate further.
Thanks!
Jes

Thank you for your reply Sirish!
I added the additional LDAP mapping and am now able to "approve" to the Role Approver stage of the workflow without CUP stopping me immediately with an error.
The audit trail now says "Request Escalated to Alternate approver"
HOWEVER, it is still not working completely.
TCUPRA2 and TCUPRA3, the users tied to the DL in which the request was excalated to, do not have authority to approve the request (and they didn't receive email notifications either; we do have this setup)
The log still shows this error:
2009-08-03 08:25:09,898 [SAPEngine_Application_Thread[impl:3]_17] ERROR  Ignoring Exception - User : BRAZIL SEC ADMINS  not found to get full name
com.virsa.ae.core.ObjectNotFoundException: User BRAZIL SEC ADMINS not found in SAP HR system
It is still trying to look back at HR for something in relation to this distrubtion group, which I do not understand at all. This is an Active Directory DL and the two users listed above are indeed tied to it. Also, these users are properly setup in our SAPHR system as well. I simply do not understand why CUP is looking for the group "BRAZIL SEC ADMINS" - I created this "group" in CUP and tied the DL to it; it is not a "user" like the error seems to be referring to.
Basically, the issue still is, users tied to the DL are not getting authority to take over the request when escalation occurs. Something still isn't completely configured or configured correctly.
Any ideas? Has anyone used DL approvers?
Thanks so much!
Jes

Similar Messages

  • Looking for good tool to report on unused Mailboxes, unused Distribution Groups, and unused Public Folders

    I have evaluated the following products.
    Quest (Dell) MessageStats
    Enow
    StealthAudit
    StealthAudit looked to be the best as they also group like mailboxes with like permissions for Office 365 migrations, but this was by far the most expensive.
    We are looking to clean up our environment to eventually migrate to Office 365.  Any advice on a product that would report on unused Mailboxes, unused Distribution Groups, and unused Public Folders that would be great.
    d

    Hi,
    In your case, you can use the following cmdlet to determine unused mailboxes. If a mailbox has never logged on, the Lastlogontime is empty.
    Get-Mailbox|Get-MailboxStatistics |fl DisplayName,Lastlogontime
    Use the cmdlet below to get publicfolder's last access time.
    Get-PublicFolderStatistics |fl name,LastAccessTime
    Get all distribution lists used over last 30 days.
    Get-MessageTrackingLog -EventId Expand -ResultSize Unlimited |Sort-Object RelatedRecipientAddress | Group-Object RelatedRecipientAddress |Sort-Object Name | Select-Object @{label=”PrimarySmtpAddress”;expression={$_.Name}}, Count
    Hope this can be helpful to you.
    Best regards,
    Amy Wang
    TechNet Community Support

  • Exchange Query (Get Distribution Groups and members) What this in a .csv

    I am unable to get the output to a CSV and give me only 1000 result.
    write-output
    “” > C:outputDGmembers.txt
    get-distributiongroup | Sort -Property DisplayName | foreach {
    $name = $_.displayname
    $output = ‘Group Name: ‘ + $Name
    write-output $output >> C:outputDGmembers.txt
    Get-DistributionGroupMember $name | Sort -Property DisplayName | Select DisplayName, Alias, Department >> C:outputDGmembers.txt
    write-output “” “” >> C:outputDGmembers.txt
    Please
    help

    Help Export-Csv -full
    HELP Get-DistributionGroupMember  -full
    Look at all of the examples.
    ¯\_(ツ)_/¯

  • CUP 5.3 SP8 - Escalation process for manager approval stage

    Hello,
    We have our basic workflow configured that when a request is created by a user, the first stage it goes to is their Manager for approval.
    We are running into the scenario; what if a Manager forgets to approve or isn't available or is out of office and can't approve the request? We think we want to setup escalation of some sort but are unsure how to go about it.
    The escalation options that we have are:
    No Escalation
    Forward to Next Stage
    Forward to Alternate Approver
    Forward to Admin
    Intially, we felt that "Forward to Next Stage" would suffice because Security Admins is our next stage. If the alloted time passed for Managers to approve the request, escalation would move the request to our Security Admins. However, "Forward to Next Stage" is essentially an Approval, meaning Security Admins will get the email saying the request was Approved, not the email saying the request was Escalated. This will cause confusion with our Security Admins; they won't know that the request was in fact escalated because they got an approval email.
    We want Security Admins to ultimately get the authority in this instance so they can see that a Manager did not review in time, or is out of office so they can forward the request to a different manager.
    Keep in mind, I do understand we can have the Manager setup approval delegation. This doesn't help us however if the manager forgets to set his approver delegator when he leaves the office or really is in the office but is unavailable due to various reasons.
    I'm curious about the option "Forward to Alternate Approver." - who is the alternate approver for managers? Is it always the delegate? Is it possible that the alternate approver is the next level up on the HR heirarchy?
    Let me know if I need to clarify my issue.
    Thanks!
    Jes Behrens

    Jes,
    We have 2 approvers for each role. We defined in the Role Approver Stage that it be routed to the alternate approver should the main approver not respond in the next 3 days (via Forward to Alternate Approver). Bear in mind, once it is escalated to the alternate approver, the main approver will not be able to view/approve the request anymore. If the alternate approver does not approve/reject the request, the request will be left as is.
    In our case, we have used the functionality in CUP to pre-define the alternate approver rather than in your case, you would want to only escalate it as and when your Security Admin decides to. I believe if your Security Admin staff has admin rights in CUP, they are able to forward it to another approver via the Administrator tab. Else you can create a new stage to foward to your admin staff if it is not action upon.

  • Would Like to Get Report of Daily Emails In and Out from Members to a DL Exchange version : 2007 I am the supervisor for the group and want to quantify this information. I do not need to see the content, just quantity is it possible ?

    Would Like to Get Report of Daily Emails In and Out from Members to a DL
    Exchange version : 2007
    I am the supervisor for the group and want to quantify this information. I do not need to see the content, just quantity
    is it possible ?

    Well, distribution groups don't really have a concept of "in" or "out". They only serve to distribute messages sent to them -- unless you're asking to know who was a member of the distribution group at the time a message was sent to the DL.
    Message tracking logs hold the information you want, though. You'd have to look for EXPAND events that reference the distribution group and take the sender's e-mail address from that event. If the DL is a simple one that's not a member of any other groups
    you could also look for RECEIVE events sent to the e-mail address of the group and get the sender's name from that event.
    You can use Powershell extract the rows of data from the logs, but you'll have to write the code to get the data out of those rows and into a format you want. Perhaps LogParser could be useful in place of Powershell?
    --- Rich Matheisen MCSE&I, Exchange MVP

  • Looking for Script Exchange-2007: Import-Mailbox Calendar Folder on multiple mailboxes {Distribution Group}

    Hi,
    I'm looking for a PowerShell script which will import a Calendar events into student's mailbox (Calendar). Those students are located in a distribution group and I would like to target the distribution group; I'm trying to simulate what I want to achieve
    in the below code example, I would appreciate if anyone jump in and advise.
    $Users = Import-Csv C:\users.csv | ForEach-Object{Get-DistributionGroup -Identity SC-1213} | Import-Mailbox -Identity $Users -PSTFolderPath c:\Calendar.pst -IncludeFolders '\Calendar' -StartDate -EndDate
    Much appreciated..
    Hussain

    The logic doesn't work unless you are using StartDate and EndDate for the period when you change the item.  As I said above, StartDate and EndDate are not the times when the meeting starts and ends - they are the times that the item was either added
    or modified in the mailbox.  Your filter was trying to pull items that were in the future.
    And as I also said above, if you import a modified item, the original is
    not going to be updated.  You will have a duplicate meeting
    on the calendar.  You would have to remove the original
    and import the updated item if this was how you wished to manage the updates.  This is not nearly as effective as
    sending meeting requests and updating those meetings.
    For example, if we do things the way you are doing them, and we add a "Student Appreciation Bonfire" meeting to the calendar for April 12 at "The Quad", we would do the following:
    On February 1, you get information for the meeting that needs to be imported
    You create this new meeting in the PST calendar - "Student Appreciation Bonfire"; Date April 12, start 8:00 AM, end 12:00 noon; Location The Quad
    You import the PST into everyone's calendar
    You receive a note on March 12 saying the venue has changed to The River Beach, so you update this meeting in your PST
    Since there are other calendar items in the PST, you import the update using StartDate of March 12 and EndDate of March 13 - the date that you changed the item, not the date the item occurs
    At this point, all users have two meetings on their calendar - the original and the update
    If, instead of doing it this way, you create a Student Actvities Calendar mailbox, you would handle it this way:
    On February 1, you get information for the meeting that needs to be imported
    You create this new meeting in the Corporate calendar - "Student Appreciation Bonfire"; Date April 12, start 8:00 AM, end 12:00 noon; Location The Quad
    You invite everyone to the meeting
    You receive a note on March 12 saying the venue has changed to The River Beach, so you update this meeting in that calendar and send out the update
    At this point, all users have only the one meeting on their calendar - the update
    Using the PST as the source for the meetings would work only for items that
    will not be changed - holidays are a good example.

  • How to add Distribution Group email alias from CSV in office 365

    Hello Forum!
    Hope someone can help me troubleshoot this or even let me know if its not possible. But, I used powershell to import distribution groups and set primary emails in Office 365. That worked great, but we have two domains and i would like to add an email alias
    to all my DGs for the other domain.
    This was my best attempt and its not going well:
    Import-CSV "C:\distributionlists.csv" | foreach {Set-DistributionGroup "$_.Name" -EmailAddresses SMTP:$_.PrimarySmtpAddress,$SecondarySmtpAddress}
    $_.Name is the column name for my DGs. IE: DL-IT
    $_.PrimarySmtpAddress is the column name for my primary email. IE: [email protected]
    $_.SecondarySmtpAddress is the column name for my email alias. IE: [email protected]

    Hi,
    Based on my understanding, the below code should work when your manually run it:
    Set-DistributionGroup "DL-accounting"
    -EmailAddresses SMTP:<Primary Email>,<Alias Email>
    If all those distribution groups have been already created, then use set-distributiongroup command should work. How about first new those distribution group, and then run foreach block to do the loop.
    Regards,
    Yan Li
    Cataleya Li
    TechNet Community Support

  • Distribution Group manager can't modify group

    Setup
    MS Exchange 2010 version 14.3 (Build 123.4)
    Distribution Group is a Mail Universal Distribution which has less than 20 members total
    There are three managers in the "Managed By" listing.  Of these two can modify the list, the third cannot.  When the third manager tries to modify the list they get the following error:
    The Public Group cannot be displayed.  The connection to Microsoft Exchange is unavailable.  Outlook must be online or connected to complete this action.
    Note: The user is connected to the Exchange environment as evidenced by the "Connected to Microsoft Exchange" in the lower right portion of his Outlook 2010 window.  He is also hardwired into the network,
    ie no wireless connection.  He tried the going in through OWA and got the same error as above.  
    Any ideas on what I can check to see why this manager cannot modify the list whereas the other two can? 
    nc

    Hi ncouch55,
    If there are multiple GCs in organization, We could refer to the following link to choose the closest GC for the specific user:
    1). Click Start, and then click Run.
    2). In the Open box, type regedit.exe, and then click OK.
    3). Locate and then click the following key in the registry:
    HKEY_CURRENT_USER\Software\Microsoft\Exchange\Exchange Provider
    Note You may have to create the registry path.
    4). On the Edit menu, click Add Value, and then add the following registry value:
    Value name: GC Server
    Data type: REG_SZ (string)
    Value data: the FQDN of the closest GC server
    5). Quit Registry Editor.
    If the issue persist, we could clear manager on distribution group and re-grant permission to three manager.
    If there are any questions regarding this issue, please be free to let me know. 
    Best Regard,
    Jim

  • ActiveDirectory module doesn't support Contacts in Distribution Groups

    Hi,
    In my AD I have several groups, of the Distribution type, whose members are a combination of Contact objects and other Distribution groups.
    If I use the Get-ADGroupMember cmdlet, the members which are Contact objects are not returned.
    If I use the Add-ADGroupMember cmdlet to add a Contact object to a Distribution group, an error is thrown claiming the Contact object cannot be found (even though Get-ADObject finds it successfully).
    As a workaround I've used ADSI to retrieve the Distribution groups and manipulate the Contact members but I feel there is a bug with the ActiveDirectory PowerShell module artificially restricting which AD object types can be members of groups.
    Regards,
    Jason

    If you have Exchange,you may using cmdlet - Add-DistributionGroupMember or using adsi.
    $group = Get-ADGroup "CN=Contacts,DC=contoso,DC=com"
    $user = Get-ADObject -Filter {name -eq "Contact1"}
    $agroup = [ADSI]"LDAP://$($group.DistinguishedName)"
    $auser = "LDAP://$($user.DistinguishedName)"
    $agroup.Add($auser)

  • Dynamic Distribution Groups - Message Delivery Restrict to Security Group

    Hi,
    I have created a dynamic distribution group and want to restrict mail delivery to only accept messages from members of a security group.  How do I achieve this?
    The idea is the DDG's are set with their criteria and if anyone leaves/joins the relevant SG then they will have permission to send to those DDG's.
    Thanks in advance.

    Hi ,
    In exchange management console it is very simple to provide the access.Please follow steps.
    1.Open the Exchange Management Console (EMC)
    2.Locate the distribution list .
    3.Right-click on it and select Properties
    4.Open the Mail Flow Settings tab
    4.Select Message Delivery Restrictions
    5.Then select the option only senders in the following list and add the DL that you would like to provide access to send email to that group.
    Thanks & Regards S.Nithyanandham

  • Recreate an alias / distribution group that was deleted

    I had an allusers@ distribution group setup in Exchange 2010 so I can send an email to all of my users.  I never remember to add new people and found out about the Dynamic Distribution Group. 
    I deleted the old allusers@ in Exchange Management Console.  I recreated allusers@ with the "New Dynamic Distribution Group" wizard in EMC.  I get it to find all of the user names and I complete the creation.
    Now when I email [email protected] I get an undeliverable message with the following error:
    IMCEAEX-_O=FIRST+20ORGANIZATION_OU=EXCHANGE+20ADMINISTRATIVE+20GROUP+20+28FYDIBOHF23SPDLT+29_CN=RECIPIENTS_CN=[email protected] #550 5.1.1 RESOLVER.ADR.ExRecipNotFound;
    not found ##
    I tried restarting the server to refresh things and that didn't solve it. 
    I tried deleteing the Dynamic Group and recreating the normal ditribution group, but that failed again.
    Creating allusers2@ as a dynamic distribution group and emails are delivered.
    I went to allusers2@ properties and the E-mail addresses tab.  I add allusers@.  When I try to send to allusers@, it fails.
    Any advice how to get allusers@ to work?

    Thanks for your continued help in this.  I deleted the allusers@ reference in my auto complete and rebooted my PC.  I waited around 45 minutes before typing in [email protected]  allusers@ didn't work, but allusers2@ did.
    This server is a Small Business Server 2011.  It hosts Exchange 2011 and our Active Directory.  Sharepoint has been configured on it, but we haven't used it yet.
    Are they any other workarounds instead of clearing the whole autocomplete file.  Like I said, my users typically use it as their contact list and will be lost without it.
    Hi,
    Yes, you can add the old legacyExchangeDN as an X500 Emailaddress on the new group you created.
    In the NDR above we can see that the value for it would be:
    /o=FIRST ORGANIZATION/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=All23a
    Martina Miskovic

  • How to make public distribution group to seend automated e-mails for acknowledgement

    My environment info :
    Exchange 2007 sp3 on Windows server 2008 R2sp1 ( Stand alone)
    I have a distribution group and i want to setup an automatic response have to be  sent to any sender to that distribution group (Like an acknowledgement e-mail stating we have received you e-mail)
    How do i set up this?
    Thanks For your help in advance.
    Regards
    Nelson
    Nelson N Exchange 2003|2007|2010

    No, you have an option in outlook client to set up this activity through server so there us no need of outlook running all the time and the outlook if needed only on the primary setup,
    I have specified the same in step by step instruction for better understanding.
    Thanks 
    Nelson
    Nelson N Exchange 2003|2007|2010

  • Regarding Dynamic distribution Group filtering! - URGENT HELP

    Hello Friends,
    We have some employess in our company having primary SMTP address as
    [email protected] as well as [email protected] as alias name.
    I want to create Dynamic distribution group using recipient filter option.. I have tried various option.. nothing is worked out. can you please someone help on how to do this?
    NOTE: I can able to filter using EMC filter : using "emailadresses" + "contains" @company2.com.......
    Karthick

    Your requirement is unclear. reply back with what you are actually looking for!
    if you want to use -RecipientFilter to Create/Manage Dynamic Distribution Groups then below are the few links which has the information about the values that you may use for -RecipientFilter
    Filterable properties for the -RecipientFilter parameter
    Filters
    in recipient Shell commands
    Using
    PowerShell to Manage Dynamic Distribution Groups and Recipient Filters in Exchange Server
    Create
    Dynamic Distribution Groups Using Customised Filters
    M.P.K ~ ( Exchange | 2003/2007/2010/E15(2013)) ~~ Please remember to click “Vote As Helpful" if it really helps and "Mark as Answer” if it answers your question, “Unmark as Answer” if a marked post does not actually answer your question. ~~ This
    Information is provided is "AS IS" and confers NO Rights!!

  • Distribution group editing

    I created three distribution groups for my client.
    Only the first one I created appears in Outlook?
    How can a user add more members to the distribution group? Can this be done from Outlook or OWA? I have not found a way.
    Thanks!
    Larry McKenzie

    Hi,
    The three distribution groups should show in Outlook when you click your Global Address List.
    I didn't have Exchange 2013, in my lab, Exchange 2010, I can manage the distribution group in the following way in Outlook.
    Click New E-mail button, choose Address Book, find the distribution group and right click the
    Properties, you can add members or remove members.
    Note you should have the managed by permission on this distribution group.
    Best regards,
    Belinda
    Belinda Ma
    TechNet Community Support

  • A distribution group with "require all senders are authenticated" checked still receives external mail

    a distribution group with "require all senders are authenticated" checked still receives external mail.  this does not happen for any other DG i am aware of.  this also happens from multiple external senders.
    please assist.
    thanks

    Hi,
    From your description, I would like to verify if the problematic Distribution Group is a member of other distribution groups that don't check "require all senders are authenticated".
    What's more, please check if there is any difference between this problematic distribution group and other normal distribution groups.
    Hope this can be helpful to you.
    Best regards,
    Amy Wang
    TechNet Community Support

Maybe you are looking for