Exchange group moderation report is a great tool for IT professionals who are using group distribution moderation feature in their Microsoft Exchange enviornment. In this blog post, I will be talking about tips and tricks when dealing with group moderation, and a great report to help you identify unhealthy moderated groups.

Exchange group moderation

Exchange group moderation is a great replacement for mail group restriction. Instead of maintaining access lists on your key mail groups, just enable moderation on them and distribute the responsibility for approval. I guess email moderation is by far, one of the most key features in Exchange, because in big enterprises, it becomes so difficult to protect large and dynamic distribution groups.

I remember those days, when we were managing monster groups like ALL EMPLOYEES distribution group. We restrict sending emails to this group, and each time someone needs to send email to that group, many things need to happen. First, we need to verify the reason of addressing such group. Later, we might require some sort of approval. Finally, we add that person to list of people who can send to that group. Then we had to wait for like 4 hours, until Exchange reads that access list from AD.

When distributions group moderation first gets introduced, it was the killer feature for us. We quickly started to migrate all key groups to moderated ones. It took us a while to introduce this change to our users, but the result was amazing. We do not worry anymore about taking care of approving any emails, or changing the access list. The moderator of each of these groups will handle that on our behalf.

How to get Exchange group moderation report?

Since we are using a lot of exchange dynamic groups, we have a lot of those groups moderated also. When you need to configure moderation for dynamic groups, you must use PowerShell to enable moderation, and assign the moderators.

Later, we got many calls from people asking “We sent an urgent email to all employees, which is moderated group. The message is not approved yet. Can you give us the name of the group’s moderator”? The interesting part is that finding the moderation information for dynamic groups requires typing some PowerShell commands. The help desk ends up calling us for such information.

I was thinking what if we can generate a list of all groups that are moderated, and a column for the moderator for that group. We can schedule this report to run on weekly basis, and send the report to the help desk for reference or something. This is the purpose of the exchange group moderation report.

Script details

The Exchange group moderation report will run and generate a csv with the following information:

Name
ModerationEnabled
ModeratedBy
BypassModerationFromSendersOrMembers
SendModerationNotifications
ManagedBy
RequireSenderAuthenticationEnabled
WindowsEmailAddress
Type

The Exchange group moderation report has an option to email you the result, so that you can easily schedule the script to run on weekly basis for example. You can download the script from Microsoft TechNet Gallery.

Exchange group moderation report [version 2]

After years dealing with exchange group moderation, I faced couple of issues that I want to share with you:

What if the moderator of a group is a disabled user? Suppose that GroupA has one moderator called John. John decided to leave the company, and his account is now disabled. Now GroupA has no moderators. Some cleanup job need to be performed frequently to check for the health and existence of the moderators.
Single Moderator Issue: The best recommendation is to have at least two moderators for each moderated group, so that if one of them is not available or on a leave, the other one can moderate that group. You may want to have a regular checks to detect moderated groups with one moderators only.

Introducing Moderation Health score

I had to make the get exchange moderation report script smarter. It will collect all moderation information we talked about previously, but it will add another extra information. The script will give you a health score for each distribution group enabled for moderation. If the group has single moderator, or empty moderator [ no moderator in case the user account who used to be moderator, is deleted], then the script will flag the group as unhealthy. The script is smart enough to identity if the user who used to be moderator, has no mailbox anymore.

The new script can be run from Exchange management console, and it will generate a csv with the following information:

Group Name
Dynamic mailing group or not
Moderators list
Bypass moderation list
Managed By list.
Email Address
Alert column if a single moderator is detected.
Health Field to indicate if one of the moderators is disabled or does not have mailbox anymore.
Empty Moderator List warning

Three Log Files will be generated also as a result of running the script that will list groups with empty moderators, and one with disabled mailbox moderators.