Got it. It ws a pemissions issue. Get-GlobalAddressList "Default Global Address List" | Add-ADPermission -User "Authenticated Users" -AccessRights GenericRead -ExtendedRights Open-Address-Book -Deny:$True denied NT Authority\Authenticated Users any access to the DGAL. I used "DSACLS distinguishedname /A" to see the permissions, and "DSACLS distinguishedname /R domain\GroupOrUserName" to remove the Deny ACL for NT Authority\Authenticated Users group.