SharePoint alerts not working for AD group members

Question

I have a SharePoint site that is restricted to users that are part of an Active Directory group (by creating a SharePoint group called site users and adding the AD group to that).

Those users are able to create alerts (to which they receive an email confirmation), but they don’t receive any email alerts when things change on the site.

However, if I add the users explicitly to the site users SharePoint group, they receive the email alerts as expected.

I’ve tried a few things found on the internet but to no avail. Any ideas why that might be happening?

Answer 1

I had a similar problem with Workflows where the email wasn't being recieved by AD distribution groups. I found this answer online, it may be the same problem you are seeing.

If you are integrating your MOSS with Exchange server 2007 to send out-going email then please try the following steps to fix your problem:
1. Go to Exchange Management Console -> Recipient Configuration -> Distribution group.
2. Right-click on the problem group and choose properties.
3. On the Mail Flow Settings tab, double click on Message Delivery Restrictions.
4. Uncheck the check box "Require that all senders are authenticated".

The link to where i found this are: Social.technet.microsoft

Answer 2

I'm not 100% sure, but I think it's as follows:

• Your user opens up the site. It's authenticated via the AD group and gains access to the site.
• The user now creates an alert. SharePoint sends out a confirmation e-mail. This is being done by getting the current context and reading the e-mail address of the current user (which is stored in the users claim probably).
• The alerts are being sent by the timer job though. Since that service doesn't have any context, it has to look up the site to which the alert belongs to. On that site, it'll query the users collection to fetch the user which created the alert and read it's e-mail address. In your case; it won't find the user cause it's simply not there. You might find an error in ULS, you might not; not sure.

If this is so; it's pretty reproducable bug. And easily fixable; SharePoint should just call EnsureUser when it creates an alert, to make sure the current user is in the users collection of the site collection. But that's for Microsoft to fix (report it!)

As for a quick & dirty solution: you could write a little powershell script which loops through the users in the AD group and calls EnsureUser on the site. That way you'll won't have any manual work. Otherwise the only option you've got is to add your users to the SharePoint group and not reuse the AD group.