Problems for adding users in DIstribution Dynamics groups with ExtensionCustomAttribute

[Vaalgruund]

Hello everyone,

I recently encouter problems for adding users in DDG with the use of extensionCustomAttribute1

In my company, we have DDG who use "tags" and theses tags are placed in the ExtensionCustomAttribute1 for each profiles

Exemple : A DDG will have these rule :

"(ExtensionCustomAttribute1 -eq '#rive_droite') -and (CustomAttribute15 -eq '29BRE') -and (RecipientTypeDetails -eq 'UserMailbox')"

In this exemple, there are 2 tags : the CustomAttribute15 (every user have this field fill to identify the location of the office and add the user on some SPO,  rules etc.) and the famous ExtensionCustomAttribute1 (in this exemple there is only one tag but we also have other conditions to check for the integrate the user in the DDG, using "-or ExtensionCustomAttribute1 -eq "xx")

The problem is that some users don't integrate the DDG when they have multiple tags on their profiles and some are added in and I don't know why ...

A case is open to MS but it's more than a month that we are working on this problem and this problem begin to seriously impact the productivity of some users :\

We already have checked the profiles, all tags are on the users but for some unknown reason the tag don't work.

There is a list of some actions that has already been done : 

- Create a new rule with the same conditions : KO

- Create a new rule using ExtensionCustomAttribute2 : OK for some users but still have issues ; kinda random

- Duplicate tags on ExtensionCustomAttribute 1and 2 and modify a test rule for having conditions checking on ECA 1 and 2 : KO

 - Using only one tag : OK 

- Modify order of the tags for one user : OK, this user is now on the DDG ; for another one DDG KO 

This problem is a real puzzle and I don't really find what's wrong ; we have 2 ideas to work in : 

- Problem with the line ECA1

- Order of tags can change the integration (and it's not the order of condition vericiation)

- Maybe the automatically added conditions by MS on the rules can cause theses troubles (conditions of types of mailboxes)

I mind if anyone else encounter or has encounter this problem and how to solve it.

All modification are done in Powershell ; there is the code : 

Creation :

Spoiler

Spoiler

Connect-ExchangeOnline

New-DynamicDistributionGroup -Name "testRD1" -RecipientFilter "(ExtensionCustomAttribute1 -eq '#rive_droite') -and (CustomAttribute15 -eq '29BRE') -and (RecipientTypeDetails -eq 'UserMailbox')"

Disconnect-ExchangeOnline -Confirm:$false

Checking tags + setting the tags (I just add or remove # to switch between get and set) : 

Spoiler

#Connection à microsoft exchange
Connect-ExchangeOnline 


####Connaitre les attributs d’une boite#### 

Get-Mailbox -Identity testbrest | select *custom* 

 
####Ajout d’attributs####

#Set-Mailbox -Identity testbrest -ExtensionCustomAttribute1 "#conseiller, #resp_thema, #rive_droite, #urbain"

#Les valeurs multiples sont valables (XYZA, XYZ2)
#####Cas de brest : #Pole_RI ; #RE ; #CODIR

 
#Maj d’attribut  
#Set-Mailbox -Identity [mail] -ExtentionCustomAttribute1 @{Add=”XYZA; Remove=”XYZ2”} 



Disconnect-ExchangeOnline -Confirm:$false

Checking the list of users on the DDG : 

Spoiler

Connect-ExchangeOnline
#### exporter les membres d'une liste de diffusion dynamique ####
Get-Recipient -RecipientPreviewFilter (get-dynamicdistributiongroup "testRD1").RecipientFilter -OrganizationalUnit $group.RecipientContainer | select displayname

Disconnect-ExchangeOnline -Confirm:$false

I don't know if I'm really clear with that problem, if I'm not, tell me I will try to explain in a better way :) 

Thanks for reading !

Vaalgruund

[#2]

@Vaalgruund 

Hey, Valgruund.

You've given us an example rule definition for a distribution group named "testRD1", which is helpful.

It would be helpful if you could provide the values of those attributes from a mailbox that is missing from the distribution group, where you are expecting that it should have been included.

For example:

Get-EXOMailbox -Identity email address removed for privacy reasons -Properties extensionCustomAttribute1, customAttribute15, recipientTypeDetails | Select-Object -Property extensionCustomAttribute1, customAttribute15, recipientTypeDetails;

Where "email address removed for privacy reasons" is the mail address of the user you thought should be in the distribution group but is missing.

Being able to see the attribute values is important to understanding whether or not they match the rule.

Here's two quick observations from your second spoiler:

1. Line 12: If you ran this Set-Mailbox, you would be adding a single string with the value of "#conseiller, #resp_thema, #rive_droite, #urbain". If you wanted to add the four tags as separate values (which I expect is what you're trying to do), they should be typed out like this: "#conseiller", "#resp_thema", "#rive_droite", "#urbain"".;
2. Line 19: Has a spelling mistake. "ExtentionCustomAttribute1" should actually be "ExtensionCustomAttribute1".

So, if you were to uncomment those lines and run them, they might not do what you expect.

The third spoiler doesn't help to make things any clearer, but it's worth noting that if the user your testing with does not live in or under "RecipientContainer", it won't appear in the list of users.

Cheers,

Lain

[#3]

@Vaalgruund 

Sorry! It seems Microsoft has some daft censoring in place, which has made a complete mess of the Get-ExoMailbox command in my post above.

Still, I'm sure you can figure out how it works.

Cheers,

Lain

[#4]

Hi @LainRobertson , Thanks for your answer ! 

I'm currently testing this point : 

---

Line 12: If you ran this Set-Mailbox, you would be adding a single string with the value of "#conseiller, #resp_thema, #rive_droite, #urbain". If you wanted to add the four tags as separate values (which I expect is what you're trying to do), they should be typed out like this: "#conseiller", "#resp_thema", "#rive_droite", "#urbain"".;

---

It seems to be the problem, it worked well few month ago but if now we have to do it like that it's OK ! :D 
I'm working on it and give my final status on the result :) 

Here is the get-exomailbox for my test member: 

Nothing seems to block the conditions so I think the problem comes from the previously mentionned point.

I keep you in touch for that, and thanks again

Vaalgruund.

[#5]

Hello,

After few tests the problem is still the same but I have seen that the rule only check the first condition without taking account of the -or but take in account the -and

At least I have a little progress, the first tag is recognized by the rule !

For information, there is my rule :

Spoiler

((((ExtensionCustomAttribute1 -eq '#conseiller') -or (((ExtensionCustomAttribute1 -eq '#garantie_jeunes') -and (CustomAttribute15 -eq '29BRE'))))) -and (-not(Name -like 'SystemMailbox{*')) -and (-not(Name -like 'CAS_{*')) -and (-not(RecipientTypeDetailsValue -eq 'MailboxPlan')) -and (-not(RecipientTypeDetailsValue -eq 'DiscoveryMailbox')) -and (-not(RecipientTypeDetailsValue -eq 'PublicFolderMailbox')) -and (-not(RecipientTypeDetailsValue -eq 'ArbitrationMailbox')) -and (-not(RecipientTypeDetailsValue -eq 'AuditLogMailbox')) -and (-not(RecipientTypeDetailsValue -eq 'AuxAuditLogMailbox')) -and (-not(RecipientTypeDetailsValue -eq 'SupervisoryReviewPolicyMailbox')))

For information (bis), when I've created the rule, this was theses conditions, MS add the conditions above automatically, it doesn't help for the tests  :

Spoiler

(ExtensionCustomAttribute1 -eq '#conseiller') -or (ExtensionCustomAttribute1 -eq '#garantie_jeunes') -and (CustomAttribute15 -eq '29BRE')

The thing that is incomprehensible is that it work well for the majority of the users, just some of them don't integrate properly on the DDG


I keep digging !

Vaalgruund

[#6 · Accepted solution]

@Vaalgruund 

The problem with the example commands is that we don't have any data to compare them against.

If you go back to the Get-ExoMailbox commandlet you used to fetch this data:

With this screenshot, we can't tell if you've provided a single value or multiple values (i.e. via using an array with Set-Mailbox.).

Then try running the following command (using your mailbox, of course.) If the values all come out on one line then you haven't run Set-Mailbox properly - as shown in the first example (in red) from the screenshot below.

(Get-ExoMailbox -Identity test.mailbox -Properties ExtensionCustomAttribute1).ExtensionCustomAttribute1;

If you have run Set-Mailbox properly, then you should find all of the values exist on their own separate line - as per the second example (in green.)

This is what I spoke about in my previous post. But if you are seeing the values on separate lines, then something else is amiss.

Cheers,

Lain

[#7]

Hello Lain,

Sorry I I understood that I only had to change the tags by "#value1", "#value2" etc.

I've tried your PS and now the result is in the format
Value1
Value2
Value3
and the user is on all DDG !

I just have to check with all users impacted but I guess that you just found the problem !
I'll check every profiles and confirm that is totaly OK with theses commands (mines are surely been interpretated like a string as you said.

Thanks Again and I try to validate this solution ASAP ;)
Vaalgruund

[#8]

Hello,

This solution seems to works well ! The problem is fixed ! Thanks a lot Lain !
You save me lol !

Vaalgruund