How to change a UDG to a USG in Exchange 2010

 

Hmm how hard can it be … Right?

Isn't is as easy as opening ADUC and changing the Group type from Distribution to Security?

Actually this not as straightforward as you might think. There is one step in this procedure that

can be easy to miss, resulting in a failure to apply the new Security group to an Exchange object.

 

If you want to skip the explanation, jump directly to the Solution section at the bottom of this blog entry.

 

Explanation

Allow me to demonstrate the problem.

So we have a group named Sales with the Recipient Type Details Mail Universal Distribution Group.

Now since we do not have any option within the Exchange Management Console or Powershell, to
change the Group type from Distribution to Security we need to use Active Directory users and computers.

We open ADUC and take properties of  the Group Sales, then we change the Group type from Distribution to Security.

Checking back in EMC we can see that the Recipient Type Details has been updated.
We have a Mail Universal Security Group instead of a Mail Universal Distribution Group.

Now, let’s use this group to set permissions.

Start Outlook and add the group Sales with permissions to my Calendar folder.

     

Add the Sales group to the Calendar folder and press ok.

 
One or more users cannot be added to the folder access list. Non-Local users cannot be given rights on this server.

Did you notice the Deny circle sign on the sales group?

  

You may receive an error message in Outlook 2007 when you try to set permissions for a distribution group on a mailbox folder in Exchange Server 2007
https://support.microsoft.com/kb/941318

Workaround suggested by KB:

To work around this issue, create security groups instead of distribution groups. Then, set folder permissions or set delegate permissions for the security groups.

 

Didn't we just change the Group type from Distribution to Security?

 

Let’s demonstrate another problem we would have with this Sales group.

 

Let’s say we want to add this Sales group with permission to a Public Folder using ExFolders.

For those of you that do not know Exfolders, information about this tool is provided here.

Exchange, meet ExFolders
https://msexchangeteam.com/archive/2009/12/04/453399.aspx

So we start ExFolders.

We select my Public Folder named Support

Right click and select Folder permissions.

Press Add and type Sales

Press Search

we get the Selected user ‘CN=Sales,CN=Users,DN=repro,DC=com’
( Well it’s a group but the UI does not update this )

When we press OK to add this Sales group to the ACL we get the following result.

  
An Error occured. Exception: Cannot use Sales as security principal Parameter name: securityPrincipal

 

Hmm. OK let’s check the SecurityPrincipal  on the group Sales

The RecipientTypeDetails shows MailUniversalSecurityGroup, which is correct! But still we are unable to use this group.

Conclusion

So, just using ADUC to change the group type is not enough.

I found the following information provided by the Romanian Exchange team.

Automatic Conversion of UDG in USG in Exchange 2007
https://blogs.technet.com/b/ehlro/archive/2010/05/11/automatic-converison-of-udg-in-usg-in-exchange-2007.aspx

In the process of manual conversion of an UDG to USG, please pay attention of a strange behavior that takes place, for each converted group: because of the manual conversion handling, the „msExchRecipientDisplayType“Attribute is not updated as expected in AD. As a consquence already converted UDG in USG are still showed (displayed) with a red Deny circle sign. Outlook 2007 will not be able to use those groups any further, although they are now the right USG, after conversion. In other words, in Outlook GAL, when you try again to assign permission for the required UDG, already manually converted to USG, those are displayed with the red deny sign. Fortunately there is a way to overcome this: just open Exchange Management Shell and for the converted USG run the following cmdlet ("set-distributiongroup") to update the attribute accordingly. You don’t have to specify any parameter, just the ID one.

For example: Set-DistributionGroup –id:Test1Group

Now you will be able to use those groups for assigning Outlook permissions. Of course don’t forget about AD replication and OAB generation in order to see the updated status of those groups.

 

So i brought up Exchange powershell again on my Exchange 2010 server.

Running the following command:  Set-DistributionGroup –identity Sales

Members can’t remove themselves from security groups. Please set the group to Closed for requests to leave.

Set-Distributiongroup–identity Sales –MemberDepartRestriction Closed

After running the above powershell command, I am able to use this Sales group in Outlook and Exfolders to assign proper permission to Exchange objects without any issues.

 

Solution

Exchange 2010

Open ADUC and change the Group Type for your group from Distribution to Security.

Start Exchange Powershell and run the following command:  

Set-Distributiongroup–identity <DistributionGroupIdParameter> –MemberDepartRestriction Closed

Exchange 2007

Open ADUC and change the Group Type for your group from Distribution to Security.

Start Exchange Powershell and run the following command:  

Set-Distributiongroup–identity <DistributionGroupIdParameter>

Comments

• Anonymous
  February 13, 2011
  Hey nice work on the article Peter!  It would be nice if they could link this blog from the article site (Article 941318) as I had exactly the same issue as above.  Cheers!  :o)

• Anonymous
  January 22, 2012
  Thanks for this article, it helped out a lot.  One typo I noticed in your command Set-Distributiongroup–identity <DistributionGroupIdParameter> –MemberDepartRestriction Closed There needs to be a space after "Set-Distributiongroup".  I tried copying and pasting your command and only changing the name of my specific group and it failed.  It worked successfully after adding the space. Thanks

• Anonymous
  November 18, 2012
  How can I change a Distribution list to Security Group using "Only Exchange Management shell" -sachin

• Anonymous
  April 08, 2014
  Just like to take a moment to let you know that this blog posting has saved me on several occasions! Thanks for taking the time to write it. --Gene

• Anonymous
  May 18, 2014
  Great article! Thanks!

• Anonymous
  June 30, 2014
  Excellent Peter.... Thank you ! You saved my day.

• Anonymous
  June 01, 2015
  Thanks. You still need to know the legacy stuff.

• Anonymous
  August 25, 2015
  There might be one step missing for Exchange 2013: Make sure you have set the MemberJoinRestriction of your Distribution Group to closed before converting it to a Security Group using the following PowerShell Command: Set-Distributiongroup–identity <DistributionGroupIdParameter> –MemberJoinRestriction Closed Afterwards I was able to convert the Distribution Group to a Security Group and use it to assign proper permission to Exchange objects. See also: social.technet.microsoft.com/.../mailbox-permission-dl-and-security-group-red-cross

• Anonymous
  December 07, 2015
  Thanks a lot..!!   Is there a way to convert Mail-Enabled Security groups to Distribution groups? I would need a script or one-liner please? Thanks in advance.

• Anonymous
  January 08, 2016
  THANK YOU! Changing membership leaving to "closed" fixed it for me.

• Anonymous
  March 09, 2016
  Thanks for the blog, it helped me resolve an issue at work! Once I removed the space as indicated above, it worked perfectly. -Set-Distributiongroup -identity Tic"&"Tac -MemberDepartRestriction Closed. As indicated in the "TicTac" name example above, I also discovered that if your security group has a ampersand in the name, you have to put quotes around the ampersand, example Tic"&"Tac. You post is very much appreciated.