'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Hide or Disable Mail for an On-Premises Security Group
Question details
The user needs to hide a mail-enabled security group from the Global Address List (GAL) or disable its mail attributes without a dedicated on-premises Exchange server.
- Product
- Active Directory / Exchange Server
- Device & OS
- not provided
- Scenario
- Managing a synchronized mail-enabled security group where the msExchHideFromAddressLists attribute is unavailable and Exchange Online cannot directly edit the on-premises source.
- Observed behavior
- Exchange Online prevents modifying the synchronized group, and standard cmdlets like Disable-DistributionGroup fail because they require an active on-premises Exchange server environment.
Ensure you have Domain Admin or Enterprise Admin privileges in your on-premises Active Directory and verify if your AD schema has been extended for Exchange.
Modify the Group Attribute via ADSI Edit
Use the ADSI Edit tool to manually update the hidden attribute in Active Directory when the Exchange Management Console is unavailable.
If you do not have an active on-premises Exchange server but your Active Directory schema was previously extended for Exchange, you can manually modify the attributes using ADSI Edit.
Be very careful when using ADSI Edit, as modifying the wrong attributes can cause severe Active Directory issues.
Press Windows + R, type 'adsiedit.msc', and press Enter to open the ADSI Edit tool on your domain controller.
Right-click 'ADSI Edit' in the left pane, select 'Connect to', leave the default settings to connect to the 'Default naming context', and click OK.
Navigate through the OU structure to find the mail-enabled security group you want to hide.
Right-click the group, select 'Properties', scroll down to locate 'msExchHideFromAddressLists', click 'Edit', and set the value to 'True'.
Open PowerShell on your Azure AD Connect server and run 'Start-ADSyncSyncCycle -PolicyType Delta' to push the changes to Microsoft 365.
Consult the Microsoft Q&A Forum for Advanced On-Premises Support
Seek specialized assistance from Microsoft Exchange experts if standard attributes are unavailable or schema extensions are required.
Looking for a reliable Office suite? Try WPS Office
While resolving Active Directory and Exchange Server configurations requires specialized IT tools, your everyday document management doesn't have to be complicated. WPS Office is a powerful, lightweight, and cost-effective alternative to Microsoft Office, perfect for IT professionals and business users alike.
- 1. Visit the WPS Website: Go to the official WPS Office website to access the free download.
- 2. Download the Installer: Click the 'Free Download' button to get the lightweight installation package for your operating system.
- 3. Install and Work: Follow the on-screen instructions to install WPS Office and instantly open your existing Microsoft Office documents.
Frequently Asked Questions
Why can't I hide a synchronized on-premises group directly in Exchange Online?
When an on-premises Active Directory is synchronized with Microsoft 365 using Azure AD Connect, the on-premises directory remains the source of authority. Exchange Online blocks direct edits to synchronized objects to prevent data conflicts during the next sync cycle.
What should I do if the msExchHideFromAddressLists attribute is missing in ADSI Edit?
If the attribute is missing, it usually means your Active Directory schema has not been extended to include Exchange attributes. You may need to run the Exchange Server setup with the /PrepareSchema switch to add these attributes to your AD environment.
How long does it take for a hidden group to disappear from the Global Address List (GAL)?
After successfully modifying the attribute in your on-premises AD and forcing a directory sync to Microsoft 365, it can take up to 24 hours for the GAL to update across all Outlook clients, including the Offline Address Book (OAB).
