Active Directory groups
This page is also in the Courier wiki: https://github.com/rsjsoftwareltd/courier/wiki/Active-Directory-groups
Courier can address a notice to the people in the Active Directory groups you already keep, such as a year group, without typing a hundred names. Courier reads group membership; it never changes anything in the directory. Only administrators can use groups for now. Audiences explains computers and people; this page is the detail for groups.
What has been tried. Active Directory groups read from a real domain have been seen working on a lab server (October 2026). The Find a group picker, Count people and Show who are new in 0.5.9 and have not yet been judged on a real domain.
1. Set up the read-only account #
Under Message Settings -> Directory, enter a read-only account as DOMAIN\username, its password, and (optionally) a domain controller. The password is encrypted for the Courier service, is never shown again and is never written to a log. Test signs in and says in words whether group lookups will work.
If your school shares a domain with other schools, also fill in Limit to these OUs: one distinguished name per line, for example OU=Example Academy,DC=school,DC=local. Empty means the whole domain.
2. Find a group #
On New notice (choose People) and on Message Settings -> Audiences (choose the Active Directory groups kind), Find a group searches group names as you type and lists what it found, with where each group lives and its description. Add puts a group in the list.
- A group outside your OUs is labelled Outside your OUs, not hidden.
- If Active Directory cannot be reached, the search is switched off and says so.
3. Count people, and Show who #
- Count people asks only when you press it, and says how many people were counted, what was left out (disabled accounts, computers, people outside your OUs) and which groups sit inside the group. People in groups inside it are counted too.
- Show who lists names only, at most 25, and says the list is not saved. It is for administrators only, and is never stored or logged.
- If Courier could not check, it says Could not check: it never shows 0.
Saving an audience #
When you save an audience made of groups, Courier checks that each group exists. A name it cannot find is refused, with "Did you mean" only from the search's own results. If Active Directory cannot be reached, the audience is saved marked Not checked.
When you send #
The preview shows each group with its number of people, the total after removing duplicates, and what was left out. The people are fixed when you send, so the notice never grows if the group changes later. If a group's members have moved since the preview, Courier asks for a fresh preview.
What is not built #
Sending to a group of computers taken from Active Directory (save a list of enrolled computers as an audience instead), people from another domain, members of a group only through their primary group (for example Domain Users), and signing in to Courier with an Active Directory account.