There has always been plenty of arguments for and against restricting the amount of recipients a user can send an email message to, however with the release of more and more destructive email virus's like VBS_STAGES, the arguments against are being distinguished.

Some users have large numbers of Distribution Lists, and some include one for the whole organisation. Usually these are at the top of the Address Book with a name such as AllStaff@outlookexchange.com. BIG MISTAKE! If a virus such as VBS_STAGES get's a hold of this DL, and you have a large organisation, imagine the impact! A Distribution List has a limit of 5000 members. If the members are other DL's this number can be extremely large!

However, it is only a matter of time before a virus is released that grabs your whole GAL. With the increase of Unified Messaging (Faxing, Voice Mail, SMS), the list gets bigger and bigger, and can affect more and more systems!

There is an answer. You can restrict the number of recipients that can be addressed per email. This works with all Exchange Server versions, though for Exchange 4.0 you need at least SP1. To implement it, you need to do the following.

1. Start Registry Editor (Regedt32.exe).

2. Locate the following key in the registry:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSExchangeIS\

ParametersSystem

3. On the Edit menu, click Add Value, and then add the following registry value:

Value Name: Max Recipients on Submit

Data Type: REG_DWORD

String: <A value equal to the max. recipients you wish to allow>

4. Quit Registry Editor.

Any email which exceeds this limit that comes into the Store from the IMC, is not delivered and is placed in the Archive directory. These is no NDR, though there is an Event 4117 generated in the event log.

Any email send by a user in the Organisation will recieve a message such as -     

The item could not be sent. The number of recipients on this message exceeds the upper limit configured by the administrator.

OR    

The item could not be sent. The client operation failed.

This solves Personal DL's and external messages, so it only leaves DL's from the GAL! Maybe it's time to start putting restrictions on who can use DL's within your organisation?