Office Communicator Error Message received when expanding a group distribution list

Here are some troubleshooting steps for when you expand a group distribution list in Communicator and you receive a message "Cannot perform this action, and the cause is unknown. Contact your system administrator to investigate this problem."

First there is the KB article 959388 that covers one particular cause but I would try the following before performing the action in https://support.microsoft.com/kb/959388.

It could be as simple as the Office Communicator signed-in user being different than Outlook logged in profile or the Outlook profile has not been configured. In this case there is no Outlook integration from Office Communicator side which is necessary to display properties of a distribution list.

Next thing to check on the Web Components server is whether IIS_WPG has sufficient permissions.

IIS Logs would show

2009-03-25 13:25:13 W3SVC1 192.168.100.186 POST /GroupExpansion/Int/service.asmx - 443 - 192.168.100.12 Microsoft+Office+Communicator/3.0 401 1 0
2009-03-25 13:25:13 W3SVC1 192.168.100.186 POST /GroupExpansion/Int/service.asmx - 443 O\F2251 192.168.100.12 Microsoft+Office+Communicator/3.0 500 0

Resolution is to check the Local Security Policy "Impersonate a client after authenticated" and add IIS_WPG group to this policy. 

This is found under Local Computer Policy->Computer Configuration->Windows Settings->Security Settings->Local Policies->User Rights Assignment

Comments

• Anonymous
  January 01, 2003
  Ah... so I found IIS_WPG is Server 2003 and IIS_IUSRS is Server 2008. Let's give that a shot. :)

• Anonymous
  January 01, 2003
  The comment has been removed

• Anonymous
  January 01, 2003
  Hi Greg, We're getting this error when trying to expand AD groups in Communicator 2007: "distribution group service could not perform this action contact your system administrator to investigate problem". The MS article in your post doesn't pertain in our situation. And our IIS_WPG has the proper permissions in Local Computer Policy. Can you think of other things that could be causing this issue? Thank you, Mike Taylor

• Anonymous
  January 01, 2003
  We've got the same 401 1 & 500 0 going on in our IIS logs of hte OCS 2007 R2 server running on 2008 SP2 when trying to expand groups. We've created a GPO to add IIS_WPG to the impersonation right, but it shows up as DOMAINIIS_WPG when you look at it through Local Policy Editor on the OCS front-end server. There is no IIS_WPG group on the server itself, does one not exist in Server 2008?

• Anonymous
  February 01, 2011
  I had this problem after moving my Root CA to a new server (With new name). I found a Forum post on removing the checkbox in IE properties > advanced tab > under "check for server certificate revocation".  This worked for me, but it was not really a fix, since not all of my clients use domain computers (So not possible to fix with a GPO).  So, I went into my Front end server and using the Certificates mmc, I renewed the address book cert using the same key. That step may not have been necessary, but it did add a couple more years to the cert expiration. Then I went into iis and reselected the renewed certificate for 443. Group expansion is now working again. So my advice is to first make sure your address book server certificate is validpool01.mydom.com/.../Handler