[Today's post comes to us courtesy of Kim Oehmichen]

Today’s blog will address the question why some groups may not show up in the SBS Console.

If you do not use the SBS provided way to create groups, they will not display in the SBS Console > Users and Groups > Groups tab. For groups to display the following two conditions must be true:

• Active Directory (AD) attribute msSBSCreationState value must be set to Created
• The group must be a Universal group

The Created AD attribute value is set for any group automatically when you use the Add a new group wizard. However, the only way to modify the AD attribute value for a group after is has been created, is to manually set the value using the Attribute Editor.  To make sure that groups always show in the SBS Console we recommend using only the Add a new group wizard.

Here is a quick review how to add a group using the Add a new group wizard from the SBS Console:

1. Start the Add new group wizard from the SBS Console’s Group tab.
   
2. Click Next on the introduction screen (if you opted out of this screen before, it will be skipped).
3. Provide a group name and appropriate group type, and then click Next.
   
4. Choose the group e-mail address and select the appropriate e-mail delivery options and click Next.
   
5. Select the group members and click Add >>
   
6. Once you added all members click Add group to complete the wizard.
   
7. Click Finish on the summary screen to complete the Add a new group wizard.
   

If you have groups that do not show in the SBS Console, there is no other way than manually changing you can download a tool to update the msSBSCreationState AD attribute or you can do it manually using the Attribute Editor.

Download the tool:

Windows SBS 2008 Active Directory Group Converter.

More information on the tool:

961148 When you open the console in Windows Small Business Server 2008, some existing groups in the MyBusiness organization unit do not appear

How do I check a group’s AD attribute “msSBSCreationState”?

1. Open the Active Directory Users and Computers from the Administrative Tools (or just type “dsa.msc” from Start > Run…)
2. In order to see AD attributes we have to select the Advanced Features in the View menu.
   
3. Browse to the OU that contains the group whose AD attribute stamp we want to check. In this example we assume that our group is in the Distribution Groups OU. Highlight the folder. Double-click the group in the right pane in order to open the properties.
   
4. Select the Attribute Editor tab and scroll down the attributes list to find the msSBSCreationState attribute.
   
5. Notice that the sbsCreationState attribute is <not set>, which is why we don’t see the group in the SBS Console.

How do I modify the AD attribute using the Attribute Editor:

1. Highlight the msSBSCreationState attribute and click edit
   
2. Change the value from <not set> to Created and click OK.
   
3. You can verify that the AD attribute has been stamped correctly by looking at the msSBSCreationState AD attribute.
   
4. Now, this group should be listed in the SBS Console: SBS Console > Users and Groups > Groups tab.
   Note: You may have to refresh this view.
   

Updated 9/2/2009 to mention the Windows SBS 2008 Active Directory Group Converter tool.