One of my first posts was regarding Distribution Groups Managers, how they work and how to set them up both through Active Directory and through PowerShell.
Recently, I wrote another post regarding the “Changes to the distribution list membership cannot be saved” error that Exchange 2010 users might receive when trying to manage Distribution Lists (DLs).
In this new post, again about DLs, I will talk about another scenario where users are not able to manage their DLs even if you followed the instructions on the previous two posts and if you transitioned from an Exchange 2003 environment.
If you still have users experiencing the following error whenever they try to add or remove a member from a DL they manage, check if the DL’s scope is set to Global:
If you can’t remember what the differences are between Group Scopes, here’s a quick (and simplified!) overview:
- Universal Group: can include accounts, global groups and universal groups from any domain of the same forest. Can be assigned permissions in any domain or forest;
- Global Group: can include accounts and global groups from the same domain. Can be assigned permissions in any domain;
- Domain Local: can include accounts, global groups and universal groups from the any domain (can also include other Domain Local groups but only from the same domain). Can be assigned permissions only in same domain.
If you look in the EMC, these DLs will most probably be greyed out and showing as Mail Non-Universal Group, which are not supported by Exchange 2010, thus causing the problem...
E-mails are still delivered to their members but you will not be able to manage or change them.
To check the Group Scope, the easier way is to use AD Users and Computers. In the following picture we can see that the DL HP-SSL-VPN is a Global DL:
To fix this issue, all you have to do is convert these DLs to Universal. You can easily do this using the EMC by sorting your DLs by Recipient Type Details, selecting the DLs you want to convert (you can select/convert multiple at a time!) and then clicking in Convert to Universal Group:
Alternatively, you can use PowerShell with the following cmdlet:
Import-Module ActiveDirectory
Get-ADGroup -Filter {(mail -like "*") -and (GroupScope -eq "Global")} | Set-ADGroup -GroupScope Universal -WhatIf
WARNING: Just make sure you want to convert all of them or update the cmdlet to only convert the ones you want to!
Exchange Server 2003
In the beginning of this post I mentioned that this might happen if you transitioned from Exchange 2003. This is because Exchange 2003 used different DL types.
To check the version of a DL, run the following cmdlet in the EMS:
Get-DistributionGroup HP-SSL-VPN | Select Name, ExchangeVersion
Name ExchangeVersion
---- ---------------
HP-SSL-VPN 0.0 (6.5.6500.0)
From the output, we can see that the Exchange version of this DL is 6.5 (Exchange 2003).
You can use the same command to see the versions of all the DLs in your environment to check exactly how many you have that are still 2003 or, possibly, 2007:
Get-DistributionGroup | Select Name, ExchangeVersion | Sort ExchangeVersion
Or if you want to group and count them:
Get-DistributionGroup | Group ExchangeVersion
Count Name
----- ----
207 0.0 (6.5.6500.0)
12 0.10 (14.0.100.0)
45 0.1 (8.0.535.0)
For these ones, if you try to add a Manager to it, you will get the following warning:
If you click Yes, Exchange will automatically convert the DL to Exchange 2010 so you can edit it.
The easiest way to convert all your DLs from Exchange 2003/2007 to Exchange 2010 is by using the 2010 EMS and simply running the following cmdlet:
Get-DistributionGroup | Set-DistributionGroup
Which will ask you the following:
To save changes on object "HP-SSL-VPN", the object must be upgraded to the current Exchange version. After the upgrade, this object cannot be managed by an earlier version of the Exchange Management Tools. Do you want to continue to upgrade and save the object?
Hope this helps!
