When you use the Active Directory Users and Computers snap-into view the permissions on a distribution group,
the message box of Special Security contains:
Windows can not edit the permissions on 'Group Name' because they have been written in a nonstandard format by another application. To enable editing, you must use the application to restore the permissions to a standard format.
When you press OK, the permissions are displayed.
To HIDE group membership, Microsoft Exchange 2000 arranges ACEs (Access Control Entry) in the ACL (Access Control List) in a non-standard order.
To view the ACEs:
1. Press the Advanced button.
2. Permissions appear with the Deny ACE displayed after the Allowed ACEs:
Type Name Permission
Allowed Exchange Domain Servers Read
Allowed Account Operators Read
Deny Everyone Read
** Other ACEs **
NOTE: Normally, the
DENY ACE is listed first.
NOTE: See Knowledge Base article Q253827 How Exchange Hides Group Membership in Active Directory.
