Corelan Cybersecurity Research

Today, I encountered an interesting problem which appeared to be strange behaviour in Exchange 2007 at first, but fianlly ended up being a small configuration mistake. It just was not that easy to troubleshoot(but in the end, it all makes sense)

This is what happened :

I created a dynamic distribution list, based on company field :

New-DynamicDistributionGroup -Name "Org-AllUsers" -Alias "Org-AllUsers" -OrganizationalUnit "mydomain.com/Company Users/Distribution Lists" -RecipientFilter {((RecipientType -eq "UserMailbox") -and (Company-eq "MyCompany"))}

When looking at the recipients inside the Dyn DL, all seems to be fine :

$AllMembers = Get-DynamicDistributionGroup -Identity "Org-AllUsers"
Get-Recipient -Filter $AllMembers.RecipientFilter

Name                      RecipientType
—-                      ————-
Peter Van Eeckhoutte      UserMailbox
TestUser 1                UserMailbox
TestUser 2                UserMailbox

When I looked at the ‘preview’ of the DL in the Exchange Management Console, the same users are returned. So far so good, nothing special here.

So I tried sending an email to my newly created DL, but nobody received my email.  So I had a look at the MessageTracking Log :

[PS] C:\>Get-MessageTrackingLog -server exchangesrv1 -MessageSubject "test" -Start "05/11/2008 11:00"

EventId  Source   Sender                 Recipients                   MessageSubject
——-  ——   ——                 ———-                   ————–
RECEIVE  STORE… peter.ve@corelan.be   {Org-Allusers@corelan.be}     test
EXPAND   ROUTING  peter.ve@corelan.be   {}                            test

[PS] C:\>

So the email was sent alright, but it did not seem to be routed anywhere. When looking at the details of the ROUTING source event, this is what I saw :

[PS] C:\>Get-MessageTrackingLog -server exchangesrv1 -MessageSubject "test" -Start "05/11/2008 11:00" | where {$_.Source –eq "ROUTING"} | FL

Timestamp               : 5/11/2008 11:01:14
ClientIp                :
ClientHostname          :
ServerIp                :
ServerHostname          : EXCHANGESRV1
SourceContext           : EXCHANGESRV1.corelan.be
ConnectorId             :
Source                  : ROUTING
EventId                 : EXPAND
InternalMessageId       : 92432
MessageId               : 18653C94B6FB304CA4BE46A4F10D12F015C7A1BD1D@EXCHANGESRV1.corelan.be
Recipients              : {}
RecipientStatus         : {250 2.1.5 RESOLVER.GRP.Expanded; distribution list expanded}
TotalBytes              : 7043
RecipientCount          : 0
RelatedRecipientAddress : Org-Allusers@corelan.be
Reference               :
MessageSubject          : test
Sender                  : peter.ve@corelan.be
ReturnPath              : peter.ve@corelan.be
MessageInfo             :

EventID : Expand, RecipientCount : 0   Since there are no recipients, the Expand Event within the Routing task was not followed by a transfer or delivery.

So although the definition of the Dynamic Distribution List seemed to be ok, no recipient could be found.

When looking at all available parameters of the New-DynamicDistributionList cmdlet, I noticed a parameter that could be the root cause of this problem :  -RecipientContainer

Apparently, when creating the DynamicDistributionList, I forgot to add the RecipientContainer. This container indicates  the scope of where the filter must be applied to. If you don’t specify anything, it’s not going to assume that you want to filter on the entire domain, it will just assume that it needs to apply to the OrganizationalUnit where you want to save the Distribution List (in my case, this is “mydomain.com/Company Users/Distribution Lists”).  This OU only contains DL objects, so this is not what we want.

So I removed my DDL again, created a new one, and set the RecipientContainer to the OU that contains the users :

New-DynamicDistributionGroup -Name "Org-AllUsers" -Alias "Org-AllUsers" -OrganizationalUnit "mydomain.com/Company Users/Distribution Lists" -RecipientFilter {((RecipientType -eq "UserMailbox") -and (Company-eq "MyCompany"))} –RecipientContainer "mydomain.com/Company Users"

I’ve sent out a new mail, and now it works.

[PS] C:\>Get-MessageTrackingLog -server exchangesrv1 -MessageSubject "TEST" -Start "05/11/2008 13:00" | where {$_.Source -eq "ROUTING"} | FL

Timestamp               : 5/11/2008 13:17:58
ClientIp                :
ClientHostname          :
ServerIp                :
ServerHostname          : EXCHANGESRV1
SourceContext           : EXCHANGESRV1.corelan.be
ConnectorId             :
Source                  : ROUTING
EventId                 : EXPAND
InternalMessageId       : 93161
MessageId               : <1F93B6AB6B24CB41A404D02C838B7D090FE17727FA@EXCHANGESRV1.corelan.be>
Recipients              : {peter.ve@corelan.be, testuser.1@corelan.be, testuser.2@corelan.be}
RecipientStatus         : {250 2.1.5 RESOLVER.GRP.Expanded; distribution list expanded}
TotalBytes              : 7404
RecipientCount          : 3
RelatedRecipientAddress : Org-AllUsers@corelan.be
Reference               :
MessageSubject          : TEST
Sender                  : peter.ve@corelan.be
ReturnPath              : peter.ve@corelan.be
MessageInfo             :

Timestamp               : 5/11/2008 13:17:58
ClientIp                :
ClientHostname          :
ServerIp                :
ServerHostname          : EXCHANGESRV1
SourceContext           : Resolver
ConnectorId             :
Source                  : ROUTING
EventId                 : TRANSFER
InternalMessageId       : 93162
MessageId               : <1F93B6AB6B24CB41A404D02C838B7D090FE17727FA@EXCHANGESRV1.corelan.be>
Recipients              : {peter.ve@corelan.be, testuser.1@corelan.be, testuser.2@corelan.be}
RecipientStatus         : {}
TotalBytes              : 7686
RecipientCount          : 3
RelatedRecipientAddress :
Reference               : {93161}
MessageSubject          : TEST
Sender                  : peter.ve@corelan.be
ReturnPath              : peter.ve@corelan.be
MessageInfo             :

© 2008, Peter Van Eeckhoutte (corelanc0d3r). All rights reserved.

Similar/Related posts:

Exchange 2007 Administration : Users, Groups and Mailboxes Exchange 2007 Administration : Antispam and Content Filtering Delegating Exchange 2007 Distribution List Management to End Users Fixing Exchange 2007 Offline Address Book generation (oalgen) and distribution issues Free tool – Extracting email addresses from Outlook mail folders