“Couldn’t find object” in Get-DistributionGroup while modifying Message Delivery Restrictions

Lately I faced the error “Couldn’t find object “FQDN/OU1/OU2/User1”. Please make sure that it was spelled correctly or specify a different object.” when I tried to add a user to the Message Delivery Restrictions list in Exchange. A colleague had asked me to add a new user to the allow-send-list of a Distribution Group in Exchange 2010. The usage of this group was constrained to only a few users because it would allow them to send email to all users in the company.

Adding a user to the Message Delivery Restrictions list is easy:

1. Double click the Distribution Group
2. Go to tab “Mail Flow Settings”
3. Double click “Message Delivery Restrictions”
4. Click Add… and find the user you want to grant permission
5. Click OK, OK, OK, and we’re done.

However, today was not a usual day. So, I got this error:

Microsoft Exchange Error
——————————————————–
The following error(s) occurred while saving changes:
Set-DistributionGroup
Failed

Error:
Couldn’t find object “FQDN/OU1/OU2/User1”. Please make sure that it was spelled correctly or specify a different object.
——————————————————-
OK

The user specified in the error was a disabled user, and the user was not listed in the GUI of the Message Delivery Restrictions. So I decided to remove the user using Powershell.

Add user to the AcceptMessagesOnlyFrom list of a Distribution Group using Powershell:

Get-DistributionGroup -id "%DistrGroup1" | Set-DistributionGroup -AcceptMessagesOnlyFrom @{Remove="User1"}

This cmdlet however also returned an error that object could not be found.

Couldn’t find object “User1”. Please make sure that it was spelled correctly or specify a different object.
+ CategoryInfo          : NotSpecified: (:) [], ManagementObjectNotFoundException
+ FullyQualifiedErrorId : 643A74EF

Fix “Couldn’t find object” in Get-DistributionGroup while modifying Message Delivery Restrictions

The solution to “Couldn’t find object” is as follows:

1. enable the disabled Active Directory user, and then
2. (re)create a mailbox for the specific user. Since the user is Exchange-enabled again,
3. you can now remove the user from the AcceptMessagesOnlyFrom list.

Note that the user is still not visible in the GUI, so you need to remove the user using the cmdlet.
If you recently disabled the mailbox in Exchange, it may still exist in the “Disconnected Mailbox” node in the Exchange Management Console -> Recipient Configuration -> Disconnected Mailbox. If so, try to reconnect the mailbox (right click -> Connect…)

Don’t forget to disable the user’s mailbox again in the Exchange Management Console, and disable the user in Active Directory afterwards.

In Exchange 2010 SP2 and later, the @{Remove=} and @{Add} is a new feature in the cmdlet.

You can, for example, remove a user from the AcceptMessagesOnlyFrom:

Get-DistributionGroup -id “DistrGroup1″ | Set-DistributionGroup -AcceptMessagesOnlyFrom @{Remove=”User1”}

Or add a user to the list:

Get-DistributionGroup -id “DistrGroup1″ | Set-DistributionGroup -AcceptMessagesOnlyFrom @{Add=”User1”}

or you can also combine multiple users and Add/Remove actions::

Get-DistributionGroup “DistrGroup1″ | Set-DistributionGroup -AcceptMessagesOnlyFrom @{Add=”User1″; Remove=”User9″,”User10”}

Cheers!