A. You create a query-based DG (i.e., a group whose membership is evaluated each time it's used rather than a DG that has a static set of members) by using the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in. To create a new query-based DG, enter a name, click Next, and under filter select "Customize filter." In the customized filter dialog box, select the Advanced tab, then select criteria for the DG's membership, such as "Name Starts with C, Name Starts with B." By default, the query you create uses an AND between the statements, which means they must both be true (which is impossible in this case). To instruct a Lightweight Directory Access Protocol (LDAP) query to use OR logic, you need to edit the LDAP statement. To do so, follow these steps:

  1. Start the Microsoft Active Directory Service Interfaces (ADSI) Edit tool (Start, Run, adsiedit.msc).
  2. Expand the domain container, then expand the actual domain (e.g. DC=savilltech, DC=com).
  3. Select the container in which you created the query-based DG--for example, CN=Users.
  4. In the right pane, double-click the name of your query-based DG--for example, CN=JusticeLeague, as the figure at Figure shows.
  5. Scroll down to the msExchDynamicDLFilter attribute and double-click it.
  6. You'll see the attribute value, which looks something like
    (&(!cn=SystemMailbox\{*\})(&(&(&(& (mailnickname=*)(|
    (&(objectCategory=person)(objectClass=user)(!(homeMDB=*))
    (!(msExchHomeServerName=*)))(&(objectCategory=person)(objectClass=user)
    (|(homeMDB=*)(msExchHomeServerName=*)))(&(objectCategory=person)
    (objectClass=contact))(objectCategory=group)(objectCategory=publicFolder)
    (objectCategory=msExchDynamicDistributionList))))
    (objectCategory=user)(cn=C*)(cn=B*))))
    Notice that our DG criteria--(cn=C*)(cn=B*)--appear at the end of the attribute. To make the query use OR logic for these values, thereby requiring only one of them to be true, insert a pipe character (|) and a space before the first criterion (cn=C*) and an additional right parenthesis after the last criterion (cn=B*). The modified DG criteria would look like this: (|(cn=C*)(cn=B*)))))
  7. Click OK.
  8. Click OK in the main property dialog box and close ADSIEdit.

When you preview the group, it should list all members that meet either of the criteria, as the figure at Figure shows.