New Dynamic Distribution Group quirkiness

I'd written about Devin's observation earlier that all new Distribution Groups created in Exchange Server 2007 do not receive internet/unauthenticated email by default (read previous post "New Distribution Groups do not receive internet email by default").

Here's some more often overlooked Dynamic Distribution Group (DDG, aka "Query-Based Distribution Group" in Exchange/Windows Server 2003) quirkiness. When creating a new Dynamic Distribution Group using the Exchange shell, you need to specify the required OrganizationalUnit parameter. This tells Exchange which OU or Container the new group should be created in. The RecipientContainer property is optional. It sets the scope of the AD query for the Dynamic Distribution Group - only the recipients from that OU or Container are returned (and thus get mail sent to that group).

If you do not specify the RecipientContainer parameter, the shell sets it to the same value as the OrganizationalUnit parameter. As a result, the query may not return any recipients at all, or may not return all the recipients you think it should. The documentation for New-DynamicDistributionGroup does point this out: "If you do not specify a value for RecipientContainer, the default search filter is the location of the dynamic distribution group in Active Directory. This location is specified by using the OrganizationalUnit parameter."

Scenario: If you create all groups in an OU or container called Distribution Groups, which has no users (or recipients other than the groups), the query will not return any users at all because its scope is now set to the Distribution Groups OU or container!

To get the RecipientContainer and OrganizationalUnit parameters of a Dynamic Distribution Group:

Get-DynamicDistributionGroup "MyGroupName" | select Name,RecipientContainer,OrganizationalUnit

The fact that there's no easy way to view "membership" (or rather, the recipients returned by the Dynamic Distribution Group's filter) for Dynamic Distribution Groups created using a custom filter, you can't easily verify whether the group's picking up the right recipients. You may test by sending messages to the new group and request a Delivery Report. However, since no recipients get returned by the filter, the messages disappear into a black hole, never to be heard from again, with no NDRs.

To get a list of recipients picked up by the filter, read previous post "HOW TO: View membership of a Dynamic Distribution Group".

Bottomline, and best-practice: It's a good idea to set the RecipientContainer property when creating new Dynamic Distribution Groups.