Forum Discussion
ERROR: The action 'Set-DistributionGroup', 'AcceptMessagesOnlyFromSendersOrMembers', can't be perfor
Use PowerShell:
Set-ADObject "DG" -replace @{authorig="DN of the object you want to grant permissions"}
- Steve_BaumanAug 20, 2019Copper Contributor
VasilMichev Thanks!!
This resolved my issue. Once I added one member using PowerShell (running as domain administrator) on my domain controller, I was able to edit it using the regular ADSI edit tool.- Gregory2190Mar 12, 2020Copper Contributor
Can you send a sample of the script? I am not getting what to put in "DG" as it keeps saying cannot find an object with that identity.
- Steve_BaumanMar 12, 2020Copper Contributor
Gregory2190 Yes absolutely, I should have posted this originally, my bad!
You must insert the full Distinguished Name of the Distribution Group in-between the quotes, and insert a users distinguished name that should be allowed to send to the group in the "authorig" quotes. For example:
Set-ADObject "cn=MyDistributionGroup,OU=Groups,DC=local,DC=com" -replace @{authorig="CN=Bauman\, Steve,OU=Users,OU=User Accounts,DC=local,DC=com"}You can find your distribution groups distinguished name by opening up Active Directory Users & Computers on your AD server, enabling "Advanced Features" (inside of the "View" top header tab), then right-clicking the object, selecting "Properties", clicking the tab "Attribute Editor", and then scrolling to find the 'distinguishedname' attribute.
Let me know if you'd like some screenshots!
EDIT
To elaborate, if you're getting the error "Cannot find an object with identity", then the Distinguished Name was not typed in properly and the query was not able to locate the object in your Active Directory. Be sure to escape commas inside of each Distinguished Name component (as shown in the example above) if your object has commas in its Common Name.
The Active Directory Users & Computers Attribute Editor tab will not allow you to edit the "authorig" attribute if there are no entries inside of it (I have no idea why honestly). But once you add at least one Distinguished Name inside of it, you can use the Attribute Editor.
- aballardAGIMar 06, 2020Copper Contributor
Steve_Bauman will this block internal users from emailing the DG?
- Steve_BaumanMar 06, 2020Copper Contributor
Yes I believe so. You can test it yourself by creating a test distribution group, setting this property, allowing it to synchronize to Office 365, then sending an email to it.
Unfortunately, deployment of this was halted internally for the company I work for, so I can't tell you for sure.