As an expert in the field of Exchange Server management, I have come across a situation where a user has been removed from multiple Exchange 2019 on-prem distribution lists. The removal was done from Active Directory and not via the Exchange Admin Center or Shell. The user who made the change is now looking for a way to reverse it.

Before we dive into resolving the issue, let’s take a look at why this happened in the first place. Removing a user from an distribution list can be a deliberate action, but it can also happen accidentally due to a misclick or a mistake in the Active Directory Users and Computers console. In this case, the user was removed from multiple lists, which suggests that the removal was done intentionally, but without proper planning and testing, it has caused unintended consequences.

When a user is removed from an distribution list, it can cause disruptions to the normal functioning of the Exchange environment. The user may no longer receive emails sent to the distribution list, and other users who rely on the list for communication may also be affected. In this case, the removal of the user from multiple lists has likely caused widespread disruptions to the organization’s email communication.

To resolve this issue, we need to first identify the logs that record changes made to distribution lists in Active Directory. The Event Viewer is a powerful tool for troubleshooting and auditing system events, including changes made to distribution lists. We can use the Event Viewer to look for any log entries related to the removal of the user from the distribution lists.

One way to do this is by following these steps:

1. Open the Event Viewer on your Active Directory domain controller.

2. In the left-hand navigation pane, expand the “System” category and click on “Event Logs”.

3. Scroll down and select the “Directory Services” log.

4. Look for any log entries related to the removal of the user from the distribution lists. These logs will typically be recorded under the “Access” or “Changes” category.

5. Take note of the log entry ID, timestamp, and the user who made the change. This information can be useful in tracking down the exact changes that were made.

Once we have identified the relevant log entries, we can use this information to reverse the changes made to the distribution lists. Here are some possible steps to take:

1. Use the Event Viewer to locate the log entry ID and timestamp of the change made to the distribution list.

2. Open the Active Directory Users and Computers console and navigate to the user account that was removed from the distribution list.

3. Check the “Member Of” tab to ensure that the user is no longer listed as a member of the distribution lists.

4. Right-click on the user account and select “Properties”.

5. In the “Property” window, click on the “Memberships” tab and look for any remaining membership in the distribution lists. If the user is still listed as a member of any of the distribution lists, remove their membership by selecting the “Remove” option.

6. Close the Property window and exit the Active Directory Users and Computers console.

By following these steps, we can reverse the changes made to the distribution lists and restore the user’s membership to the lists. It is important to note that this process may take some time, depending on the number of distribution lists affected and the size of your organization’s Active Directory environment.

In conclusion, removing a user from multiple Exchange 2019 on-prem distribution lists can cause unintended consequences and disruptions to the normal functioning of the Exchange environment. To resolve this issue, we need to identify the relevant log entries recorded in the Event Viewer and use this information to reverse the changes made to the distribution lists. By following these steps, we can restore the user’s membership to the lists and prevent any further disruptions to the organization’s email communication.