Exchange Server dynamic distribution groups: filter errors, missing members and previews

A dynamic distribution group has no member list: Exchange Server works out who gets the message each time someone sends to it, using the group's filter. That's convenient until people are missing, the wrong people get the mail, or the shell refuses your filter. In this post I'll show how to read what the group really evaluates, preview its members, fix the usual filter mistakes and prove the result.

Symptoms#

• Some users who should receive mail sent to the group don't, while others who shouldn't do.
• Users moved to Exchange Online stopped receiving mail sent to an on-premises dynamic group.
• Creating or changing the filter fails in the Exchange Management Shell:

Cannot bind parameter 'RecipientFilter' to the target. Exception setting "RecipientFilter": "Invalid filter syntax. For a description of the filter parameter syntax see the command help.
"<your filter>" at position <n>."

• External senders get an NDR containing 5.7.1 RESOLVER.RST.AuthRequired; authentication required.
• The Exchange admin center shows no editable membership rules for the group.

Why it happens#

• The recipient container is too narrow. The filter applies only to recipients inside the group's RecipientContainer. If you don't set it when you create the group in the shell, it defaults to the OU where the group itself was created, so a group created in the Users container ignores everyone in other OUs.
• Precanned vs custom filters. A group uses either precanned settings (IncludedRecipients plus conditions such as company, department, state or custom attributes) or a custom OPATH RecipientFilter. Custom filters can be managed only in the shell, which is why the EAC shows nothing to edit.
• Values must match exactly. A precanned condition for Washington doesn't match a user whose state is WA (matching isn't case-sensitive, though).
• Link properties need a distinguished name. Properties that point to another object, such as Manager, MemberOfGroup or Database, store the DN. A name, email address or GUID is accepted by the syntax but matches nothing, so the group silently comes up empty.
• The wrong recipient type. RecipientTypeDetails -eq 'UserMailbox' excludes shared and resource mailboxes, and also remote mailboxes. After a mailbox moves to Exchange Online, its on-premises object becomes a RemoteUserMailbox (recipient type MailUser), so a "mailbox users only" filter drops every migrated user.
• Syntax and unsupported properties. Missing single quotes around values, unbalanced parentheses, variables inside braces, or a property that isn't on Exchange's list of filterable properties (employeeType is a common example) all produce the invalid filter syntax error.
• Anything that matches is a member. Hidden mailboxes and accounts that just had an attribute changed are included if they match the filter.
• Sender restrictions. By default only senders inside the organization can send to a new dynamic group, which explains the AuthRequired NDR for external senders.

How to fix it#

1. Read what Exchange actually evaluates.
   PowerShell

   Get-DynamicDistributionGroup "All Sales" |
       Format-List Name, RecipientContainer, IncludedRecipients, RecipientFilter, RequireSenderAuthenticationEnabled

   The stored RecipientFilter is longer than what you typed: Exchange appends exclusions for system mailboxes. That's expected; focus on your own conditions.
2. Preview the members. This is the on-premises way to see who would get the next message:
   PowerShell

   $ddg = Get-DynamicDistributionGroup "All Sales"
   Get-Recipient -ResultSize Unlimited -RecipientPreviewFilter $ddg.RecipientFilter -OrganizationalUnit $ddg.RecipientContainer |
       Sort-Object Name | Format-Table Name, RecipientTypeDetails, Department -AutoSize

3. Compare a missing user with the filter.
   PowerShell

   Get-Recipient "Lina Haddad" |
       Format-List Name, RecipientType, RecipientTypeDetails, Department, Company, CustomAttribute10, OrganizationalUnit, HiddenFromAddressListsEnabled

   A different OU, a typo in the department or a RemoteUserMailbox type usually jumps out.
4. Widen the container if needed.
   PowerShell

   Set-DynamicDistributionGroup "All Sales" -RecipientContainer "contoso.com"

5. Rewrite the filter with correct quoting. Put the whole filter in double quotes and each value in single quotes. Include remote mailboxes if the group must reach migrated users:
   PowerShell

   Set-DynamicDistributionGroup "All Sales" -RecipientFilter "((RecipientTypeDetails -eq 'UserMailbox') -or (RecipientTypeDetails -eq 'RemoteUserMailbox')) -and (Department -eq 'Sales')"

   For link properties, look up the DN first and use a variable:
   PowerShell

   $mgr = (Get-Recipient "Omar Nasser").DistinguishedName
   Set-DynamicDistributionGroup "Omar's team" -RecipientFilter "(RecipientTypeDetails -eq 'UserMailbox') -and (Manager -eq '$mgr')"

   If the filter contains $true, $false or $null, don't use double quotes, because PowerShell would expand them. Use braces (fine as long as there are no variables), for example to leave out hidden mailboxes:
   PowerShell

   Set-DynamicDistributionGroup "All Sales" -RecipientFilter {(RecipientTypeDetails -eq 'UserMailbox') -and (Department -eq 'Sales') -and (HiddenFromAddressListsEnabled -eq $false)}

6. Use only filterable properties. If a property fails with the syntax error even though your quoting is right, check Microsoft's list of filterable RecipientFilter properties. Map the data to a property that is filterable, such as one of CustomAttribute1 to CustomAttribute15.
7. Allow external senders only if you mean to.
   PowerShell

   Set-DynamicDistributionGroup "All Sales" -RequireSenderAuthenticationEnabled $false

Verify the fix#

• Run the preview again. Good looks like the expected number of recipients, with the missing user now listed: (Get-Recipient -ResultSize Unlimited -RecipientPreviewFilter $ddg.RecipientFilter -OrganizationalUnit $ddg.RecipientContainer).Count. Read $ddg again after any change so you don't preview the old filter.
• Send a test message and look for the expansion in message tracking:
  PowerShell

  Get-MessageTrackingLog -EventId EXPAND -MessageSubject "DDG test" -Start (Get-Date).AddHours(-1) -ResultSize Unlimited |
      Format-List Timestamp, RelatedRecipientAddress, RecipientCount, Recipients

  RelatedRecipientAddress is the group, and Recipients lists the members it expanded to. Run it on each Mailbox server, or see Message tracking on Exchange Server for searching them all.
• Ask an external sender to retry if you relaxed sender authentication; the AuthRequired NDR should no longer appear.

Prevent it next time#

• Set RecipientContainer explicitly whenever you create a group in the shell.
• Preview every new or changed filter before announcing the group, and keep the preview command with the group's documentation.
• Keep the attributes the filter depends on consistent at provisioning time: one spelling per department, office or state.
• In hybrid, decide whether each group should reach cloud mailboxes and include RemoteUserMailbox where it should. My guide to remote mailboxes in Exchange hybrid explains these objects.
• Groups that need explicit, auditable membership are better as ordinary distribution groups.

References#

• Manage dynamic distribution groups in Exchange Server (Microsoft Learn)
• Filterable properties for the RecipientFilter parameter (Microsoft Learn)