[GUIDE] Hide users from Global Address List in AD Hybrid Joined Domains.


Recommended Posts

My company recently deployed a Hybrid Joined environment, and we came across an issue where the Entra and Admin portals were not allowing us to hide accounts from the global address list any longer. Here is the solution I came up with the resolve the issue.

1) on the Machine hosting the AD Connect tool. Open Synchronization Rules Editor.

2) Verify Direction is set to "Inbound" and then click "Add new Rule" On the right side.

image.png.c008691f482ef3031e2aa5789d71404d.png

3) Give it a name like "Hide user from GAL" or whatever makes sense to you. Connected System is your Local Domain, Connected System Object Type "User", Metaverse object type "Person", Link Type "Join", Precedence "50", then leave Tag, Enable Password Sync, and Disabled alone.

image.png.0232cdcdebf194a9ded046d2ac21bbb7.png

4) Hit Next, and Skip, "Scoping Filter, and Join Rules"

5) on Transformation rules, set Flow Type to "Expression", Target Attribute to "msExchHideFromAddressLists", then set Merge Type to "Update" Use the following script in the "Source" field.
 

IIF(IsPresent([msDS-cloudExtensionAttribute1]),IIF([msDS-cloudExtensionAttribute1]="HideFromGAL",True,False),NULL)

6) Thats the Hard part done. Now you need to manipulate each user account that you want to be hidden. You have 2 options here, you can use PowerShell, or just AD Users and Computers.

7) The PowerShell way.

8 ) Run PowerShell as a Domain Admin and simply run the command below.

Set-ADUser -Identity "FULL USERNAME" -Replace @{'msDS-cloudExtensionAttribute1'="HideFromGAL"}

9) The AD Users and Computers way

10) Open AD Users and Computers and click View to Verify "Advanced Features" is enabled.

11) Manually navigate to the user that needs hidden. unfortunately you cannot use the Search command here because when you search for a user Attrribute editor is not available.

12) on the user in question go to the Attribute Editor tab and then look for "msDS-cloudExtensionAttribute1", and set it to "HideFromGAL"

13) Once you have updated the user, either way for the AD to Azure Sync or force it to run. (You can do that from the machine running the Azure AD Connect by running PowerShell as an admin and running the following command.)

start-adsyncsynccycle -policytype delta

 

Can I assume you removed your last exchange box\management tools?

If Exchange wasn't present, extend the AD schema (using the Exchange setup) and install the Exchange management tools, you'll be able to hide the a user from a GAL in a supported\non hacky way.

https://learn.microsoft.com/en-us/Exchange/plan-and-deploy/prepare-ad-and-domains?view=exchserver-2019

In this circumstance we are not using self-hosted Exchange we are using M365 Exchange so there are no management tools other than the include Exchange admin center, Entra, and M365 Admin Center. All of which when you attempt to Hide a user from GAL you receive a Generic error message. The check boxes are there it just refuses to comply. I even tried using the Attribute editor to set " msExchHideFromAddressLists" attribute to True however, it did nothing.

image.png

I understand what you've got configured, the supported method of hiding from the GAL is to extend the AD schema with the Exchange attributes. Once you've done that you'll be able to install the Exchange management tools (Exchange shell specifically), and hide users from the GAL.

...I know because this is exactly what I've configured in many greenfield deployments in the past several years, on-prem AD becomes the source anchor when you turn on directory sync.

To be clear, you don't need a full Exchange Server configured.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Posts

    • Thanks Nik and thanks Mind. Nik: Just on the off chance, you don't know where I could get this part at cheaper than normal price do you? I tried I few places but the I can find it at is 70GBP? Just gonna have to suck it up and buy the add-on for my PC. Thank you guys.
    • Underwhelming update. Same as 12,13,14,15. Then M3E ain't showing up until Q3
    • Smart Launcher seems a better option right now.
    • Mistral AI's new 'Magistral' models bring traceable, faster AI reasoning by Paul Hill One of Europe’s leading AI companies, Mistral, has announced the availability of its Magistral reasoning model. It comes in two versions: there is the open-source Magistral Small (24B parameters) and the enterprise-focused Magistral Medium. Magistral has been designed to better handle domain-specific tasks such as law, finance, and engineering. It shows users the model’s thought processes so that it’s more transparent, and it supports multilingual reasoning to perform better when tasked with answering non-English queries. Key features and performance Mistral compared its new models against DeepSeek R1 in various benchmarks. Ones that stood out were its results on AIME2024, which assesses reasoning capabilities. Magistral Medium scored 73.6% (90% with majority voting @64) while Small scored 70.7% (83.3% respectively). If you’ve used DeepSeek R1, you’ll have seen it thinking before answering. Magistral now does this too and can do it across multiple languages, including English, French, Spanish, German, Italian, Arabic, Russian, and Simplified Chinese. Interestingly, there’s also a Flash Answers mode that speeds up the thinking for 10x faster responses compared to competitors. Real-world applications and availability Thanks to the expertise Magistral has been trained on, organizations across multiple fields, including legal research, financial forecasting, and regulated industries, may be able to turn to Magistral for more reliable answers. Its traceable reasoning also makes it ideal in regulated fields for compliance and auditability. Magistral Small, the open-source model, is available under an Apache 2.0 license via Hugging Face. Magistral Medium is accessible through Mistral's Le Chat and via API on La Plateforme. It’ll also be arriving soon on Amazon SageMaker, IBM WatsonX, Azure AI, and Google Cloud Marketplace. The easiest way for readers to try it out is on Mistral's Le Chat platform; just head to chat.mistral.ai to get started. Source: Mistral
    • Didn't know this thanks, useful.
  • Recent Achievements

    • Week One Done
      elsa777 earned a badge
      Week One Done
    • One Month Later
      elsa777 earned a badge
      One Month Later
    • First Post
      K Dorman earned a badge
      First Post
    • Reacting Well
      rshit earned a badge
      Reacting Well
    • Reacting Well
      Alan- earned a badge
      Reacting Well
  • Popular Contributors

    1. 1
      +primortal
      544
    2. 2
      ATLien_0
      272
    3. 3
      +FloatingFatMan
      207
    4. 4
      +Edouard
      201
    5. 5
      snowy owl
      139
  • Tell a friend

    Love Neowin? Tell a friend!