Sunday, July 20, 2008

Exchange2007:Multiple Global Address Lists and GlobalAddressList attribute

ADSIEDIT.msc

Microsoft Exchange

globalAddressList attribute has the following:


By default, the globalAddressList2 attribute is not configured. With the following setting, the new users which are members of Rogers global address list can be set up in OUTLOOK CLIENTS. The members of Rogers global address list don't belong to the Default Global Address List.

This is the best method.. I added more GALs in the globalAddressList2 but it didn't work. The OUTLOOK Client still cannot locate the address list.

What do I do?
For users from Shaw global address list, I add the Shaw GAL to the globalAddressList2. For users from Telus GAL, I kept only the Telus GAL in the globalAddressList2.
==========
The following method will be better.

By default, Default Global Address list includes all mail object. If one exchange organization hosts two or more companies, such as Shaw, Telus, and Rogers, you must modify the PurportedSearch filter of Default Global Address List. If not, all outlook clients will see all the mail objects.

Don't take the purportedsearch attribute lightly. When you set up a new outlook client, the user must be included in the default global address list.

What do I do? The PurportedSearch attribute must use the LDAP filter.

I learn the LDAP filter from the Exchange Management Console wizard.

new-DynamicDistributionGroup -Name 'Shaw Customers' -IncludedRecipients 'MailboxUsers' -ConditionalCompany 'Shaw' -OrganizationalUnit 'terrace.com/Shaw' -Alias 'ShawCustomers' -RecipientContainer 'terrace.com/Shaw'
//please remove the [ ]

Get-DynamicDistributionGroup 'Shaw Customers' [ ]format-list *Filter*
RecipientFilter : ((Company -eq 'Shaw' -and RecipientType -eq 'UserMailbox' ) -and -not(Name -like 'SystemMailbox{*') -and -not(Name -like 'CAS_{*'))
LdapRecipientFilter : (&(company=Shaw)(objectClass=user)(objectCategory=person)(mailNickname=*)(msExchHomeServerName=*)(!(name=SystemMailbox{*))(!(name=CAS_{*)))
RecipientFilterType : Precanned

From the DynamicDistributionGroup, I get the LDAP filter.

Using ADSIEDIT.msc tool

I copy the LdapRecipientFilter to the purportedsearch attribute of Default Global Address List and copy the RecipientFilter to msExchQueryFilter of Default Global Address list.
New mailbox user will have the company attribute set to SHAW. After it is configured in outlook, I change the company name to Telus, for example.

Don't forget to modify permissions for Global Address List. By default, Authenticated Users are granted READ and OPEN ADDRESS LIST. You should remove these two permissions.

I create a group for Telus, a group for Shaw, and a Group for Rogers. Telus group has the READ and OPEN ADDRESS LIST permissions to Telus global address list; shaw group has the READ and OPEN ADDRESS LIST permissions to Shaw global address list.

For outlook client in the Exchange 2007 computer, because the cache mode in OUTLOOK, global address list will not reflect the membership change right away. After I disable the cache mode and restart outlook, the global address list is correct. And then, enable the cache mode.

For outlook client in computer other than Exchange 2007, after you modify the company parameter and update-globaladdresslist, you should see the Global Address List reflecting the change!!!!!!!!!

Make sure your offline address list and global address list match each other. Telus users are hosted in telus database. Their offline address list includes all users from Telus. The Global Address List includes all users whose Company attribute is set to Telus. When you create mailboxes for Telus users, make sure the mailbox database is Telus database.

When you create a new mailbox for Telus user, specify the Company Attribute to TLC (because the purportedSearch is filtered to TLC, see above). So, the Default Global Address List includes the new mailbox user. After the outlook client is configured, set the company attribute to Telus for the mailbox user.