Hiding Distribution Group Membership – Exchange 2010

In Exchange 2003, hiding the membership of a distribution list was as easy as right click>Exchange Tasks>Hide Membership in the Exchange System Management console.

This feature is not available natively in Exchange 2010 due to the way permissions are assigned in later versions of Exchange, and was removed as a feature as it is an unsecure way of achieving the end result (looking at a user in the GAL will show what groups they are a member of).

The replacement method provided by Microsoft is to use  Dynamic Distribution Groups which enumerate the group membership based on an LDAP query for a particular attribute being set on the user object, therefore membership is determined by the Hub Transport server at the point it is delivering the message.

If you do not wish to convert to dynamic groups, there is an alternative method, whereby an attribute on the Distribution Group object, which is accessible via ADSIEdit, named ‘hideDLMembership’ can be set to true, which will prevent the expansion of groups in Outlook and OWA.

Attempting to expand the DL membership in Outlook will give the following error message:

This is obviously not an ideal way to manage this, and does not provide a very elegant end-user experience, but does provide a workaround to the issue.

One thought on “Hiding Distribution Group Membership – Exchange 2010

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s