Microsoft: Transport Rules Still Apply After Removed Group Membership

You might wonder why the transport rules still apply after you have removed the group membership of an user.

When you define a transport rule using a predicate that expands membership of a distribution group, the resulting list of recipients is cached by the Hub Transport server that applies the rule. This is known as the Expanded Groups Cache and is also used by the Journaling agent for evaluating group membership for journal rules. By default, the Expanded Groups Cache stores group membership for four hours. Recipients returned by the recipient filter of a dynamic distribution group are also stored. The Expanded Groups Cache makes repeated round-trips to Active Directory and the resulting network traffic from resolving group memberships unnecessary.

In Exchange 2010, this interval and other parameters related to the Expanded Groups Cache are configurable. You can lower the cache expiration interval, or disable caching altogether, to ensure group memberships are refreshed more frequently. You must plan for the corresponding increase in load on your Active Directory domain controllers for distribution group expansion queries. You can also clear the cache on a Hub Transport server by restarting the Microsoft Exchange Transport service on that server. You must do this on each Hub Transport server where you want to clear the cache. When creating, testing, and troubleshooting transport rules that use predicates based on distribution group membership, you must also consider the impact of Expanded Groups Cache.

To modify distribution group cache settings. For example, modify the time for which group membership is stored in the cache, or increase the cache size. To do this, modify the EdgeTransport.exe.config file ( Location: C:\Program Files\Microsoft\Exchange Server\v14\Bin ). The following excerpt from the EdgeTransport.exe.config file shows some of these settings.
<configuration>
 <runtime>
    <gcServer enabled="true" />
 </runtime>
 <appSettings>
  <add key=" Transport_IsMemberOfResolver_ResolvedGroupsCache_ExpirationInterval"  value ="03:00:00"/>
  <add key="Transport_IsMemberOfResolver_ResolvedGroupsCache_CleanupInterval" value = "00:01:00"/>
  <add key="Transport_IsMemberOfResolver_ResolvedGroupsCache_PurgeInterval" value= "00:01:00"/>
  <add key="Transport_IsMemberOfResolver_ResolvedGroupsCache_MaxSize" value = "32MB"/>
  <add key="Transport_IsMemberOfResolver_ExpandedGroupsCache_ExpirationInterval" value = "03:00:00"/>
  <add key="Transport_IsMemberOfResolver_ExpandedGroupsCache_CleanupInterval" value = "01:00:00"/>
  <add key="Transport_IsMemberOfResolver_ExpandedGroupsCache_PurgeInterval" value= "00:05:00"/>
  <add key="Transport_IsMemberOfResolver_ExpandedGroupsCache_MaxSize" value = "512MB"/>
</appSettings>