Hi,

This one has me in a bit of a muddle. What would the best way to deny WriteProperty member rights (to add or remove members) to a Distribution Group, except for a small group of people?

The first way that I thought of was to block inheritance and set explicit allow rights for the small group. But this stops more than just the requirement of adding or removing members. And could have other unintended consequences.

The second way I thought of was to add an explicit Deny Everyone writeproperty and then add an explicit Allow writeproperty to the group of users. But as far I can remember an explicit deny will override an explicit allow.

Anyone have a solution?

Cheers,

Jeremy

I might be missing something here, but why don't you just use the relevant attributes - set membership to closed and add the Group as owner?

Hi Jeremy,

If its going to be managed within Exchange consoles, you might want to check if you can utilize RBAC to achieve same goal.