Please consider donating: https://www.corelan.be/index.php/donate/


17,888 views

Dynamic Distribution Lists not working as expected (0 recipients during mail routing)

Today, I encountered an interesting problem which appeared to be strange behaviour in Exchange 2007 at first, but fianlly ended up being a small configuration mistake. It just was not that easy to troubleshoot(but in the end, it all makes sense)

This is what happened :

I created a dynamic distribution list, based on company field :

New-DynamicDistributionGroup -Name "Org-AllUsers" -Alias "Org-AllUsers" -OrganizationalUnit "mydomain.com/Company Users/Distribution Lists" -RecipientFilter {((RecipientType -eq "UserMailbox") -and (Company-eq "MyCompany"))}

When looking at the recipients inside the Dyn DL, all seems to be fine :

$AllMembers = Get-DynamicDistributionGroup -Identity "Org-AllUsers"
Get-Recipient -Filter $AllMembers.RecipientFilter

Name                      RecipientType
—-                      ————-
Peter Van Eeckhoutte      UserMailbox
TestUser 1                UserMailbox
TestUser 2                UserMailbox

When I looked at the ‘preview’ of the DL in the Exchange Management Console, the same users are returned. So far so good, nothing special here.

So I tried sending an email to my newly created DL, but nobody received my email.  So I had a look at the MessageTracking Log :

[PS] C:\>Get-MessageTrackingLog -server exchangesrv1 -MessageSubject "test" -Start "05/11/2008 11:00"

EventId  Source   Sender                 Recipients                   MessageSubject
——-  ——   ——                 ———-                   ————–
RECEIVE  STORE… peter.ve@corelan.be   {Org-Allusers@corelan.be}     test
EXPAND   ROUTING  peter.ve@corelan.be   {}                            test

[PS] C:\>

So the email was sent alright, but it did not seem to be routed anywhere. When looking at the details of the ROUTING source event, this is what I saw :

[PS] C:\>Get-MessageTrackingLog -server exchangesrv1 -MessageSubject "test" -Start "05/11/2008 11:00" | where {$_.Source –eq "ROUTING"} | FL

Timestamp               : 5/11/2008 11:01:14
ClientIp                :
ClientHostname          :
ServerIp                :
ServerHostname          : EXCHANGESRV1
SourceContext           : EXCHANGESRV1.corelan.be
ConnectorId             :
Source                  : ROUTING
EventId                 : EXPAND
InternalMessageId       : 92432
MessageId               : 18653C94B6FB304CA4BE46A4F10D12F015C7A1BD1D@EXCHANGESRV1.corelan.be
Recipients              : {}
RecipientStatus         : {250 2.1.5 RESOLVER.GRP.Expanded; distribution list expanded}
TotalBytes              : 7043
RecipientCount          : 0
RelatedRecipientAddress : Org-Allusers@corelan.be
Reference               :
MessageSubject          : test
Sender                  : peter.ve@corelan.be
ReturnPath              : peter.ve@corelan.be
MessageInfo             :

EventID : Expand, RecipientCount : 0   Since there are no recipients, the Expand Event within the Routing task was not followed by a transfer or delivery.

 

So although the definition of the Dynamic Distribution List seemed to be ok, no recipient could be found.

When looking at all available parameters of the New-DynamicDistributionList cmdlet, I noticed a parameter that could be the root cause of this problem :  -RecipientContainer

Apparently, when creating the DynamicDistributionList, I forgot to add the RecipientContainer. This container indicates  the scope of where the filter must be applied to. If you don’t specify anything, it’s not going to assume that you want to filter on the entire domain, it will just assume that it needs to apply to the OrganizationalUnit where you want to save the Distribution List (in my case, this is “mydomain.com/Company Users/Distribution Lists”).  This OU only contains DL objects, so this is not what we want.

So I removed my DDL again, created a new one, and set the RecipientContainer to the OU that contains the users :

New-DynamicDistributionGroup -Name "Org-AllUsers" -Alias "Org-AllUsers" -OrganizationalUnit "mydomain.com/Company Users/Distribution Lists" -RecipientFilter {((RecipientType -eq "UserMailbox") -and (Company-eq "MyCompany"))} –RecipientContainer "mydomain.com/Company Users"

I’ve sent out a new mail, and now it works.

 

[PS] C:\>Get-MessageTrackingLog -server exchangesrv1 -MessageSubject "TEST" -Start "05/11/2008 13:00" | where {$_.Source -eq "ROUTING"} | FL

Timestamp               : 5/11/2008 13:17:58
ClientIp                :
ClientHostname          :
ServerIp                :
ServerHostname          : EXCHANGESRV1
SourceContext           : EXCHANGESRV1.corelan.be
ConnectorId             :
Source                  : ROUTING
EventId                 : EXPAND
InternalMessageId       : 93161
MessageId               : <1F93B6AB6B24CB41A404D02C838B7D090FE17727FA@EXCHANGESRV1.corelan.be>
Recipients              : {peter.ve@corelan.be, testuser.1@corelan.be, testuser.2@corelan.be}
RecipientStatus         : {250 2.1.5 RESOLVER.GRP.Expanded; distribution list expanded}
TotalBytes              : 7404
RecipientCount          : 3
RelatedRecipientAddress : Org-AllUsers@corelan.be
Reference               :
MessageSubject          : TEST
Sender                  : peter.ve@corelan.be
ReturnPath              : peter.ve@corelan.be
MessageInfo             :

Timestamp               : 5/11/2008 13:17:58
ClientIp                :
ClientHostname          :
ServerIp                :
ServerHostname          : EXCHANGESRV1
SourceContext           : Resolver
ConnectorId             :
Source                  : ROUTING
EventId                 : TRANSFER
InternalMessageId       : 93162
MessageId               : <1F93B6AB6B24CB41A404D02C838B7D090FE17727FA@EXCHANGESRV1.corelan.be>
Recipients              : {peter.ve@corelan.be, testuser.1@corelan.be, testuser.2@corelan.be}
RecipientStatus         : {}
TotalBytes              : 7686
RecipientCount          : 3
RelatedRecipientAddress :
Reference               : {93161}
MessageSubject          : TEST
Sender                  : peter.ve@corelan.be
ReturnPath              : peter.ve@corelan.be
MessageInfo             :

 

 

 

 

© 2008, Peter Van Eeckhoutte (corelanc0d3r). All rights reserved.

One Response to Dynamic Distribution Lists not working as expected (0 recipients during mail routing)

Corelan Training

We have been teaching our win32 exploit dev classes at various security cons and private companies & organizations since 2011

Check out our schedules page here and sign up for one of our classes now!

Donate

Want to support the Corelan Team community ? Click here to go to our donations page.

Want to donate BTC to Corelan Team?



Your donation will help funding server hosting.

Corelan Team Merchandise

You can support Corelan Team by donating or purchasing items from the official Corelan Team merchandising store.

Protected by Copyscape Web Plagiarism Tool

Corelan on Slack

You can chat with us and our friends on our Slack workspace:

  • Go to our facebook page
  • Browse through the posts and find the invite to Slack
  • Use the invite to access our Slack workspace
  • Categories