Active Directory and Exchange ActiveSync

wk6838 used Ask the Experts™
Can anyone tell me if there is a way to control access to Exchange Active Sync for all users,

Basically, we only want this to be available to Exec level i-phone users and would like to prevent anyone else from accessing.

We have thousands of users so do not want to go into Exchnage properties of each user to disable User Initiated Synchronisation.
Can a security group be used?


Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Awarded 2009
Top Expert 2010

Which version of Exchange are you using?
You can turn off mobile/webmail access in the Exchange Features tab (either in Active directory or Exchange Management Console - depending on which version you are using)


Exchange 2003 -

I understand you can turn the feature off but I want to do it quicky and not manually for each ad account?
your only solution is to make that adjustment on all the accounts in your organization, since it was not already configured in the global settings. use admodify to make the mass change on all your users, its a breeze to use, just read through the documentation provided with the files. link is

hope this helps.
Success in ‘20 With a Profitable Pricing Strategy

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Here's a script that will disable all 3 mobile services features for every user account in the domain.  You will need to manually enable the users you want to have access.

Cut-n-Paste the script into a text file with a .vbs extension.  You will need to change the Log File Path in the first line.  You also need to Find & Replace 'MYDOMAIN' with your domain name in 2 places in the script.

Also, if you prefer to use ADModify, the attribute you need to change is 'msEXCHOmaAdminWirelessEnable'.  Change it to "7" to disable all 3 mobile services features.
strLogFile = "c:\test\ChangeUserAttribute.txt"


Set objConnection = CreateObject("ADODB.Connection")
Set objCommand =   CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objFSO = WScript.CreateObject("Scripting.FileSystemObject")
Set objLogFile = objfso.CreateTextFile(strLogFile, True)

Set objCommand.ActiveConnection = objConnection
objCommand.CommandText = _
    "Select Name,samaccountname from 'LDAP://DC=mydomain,DC=com' " _
        & "Where objectCategory ='user'"  
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE 
Set objRecordSet = objCommand.Execute

Do Until objRecordSet.EOF
	strUser = objRecordSet.Fields("samaccountname").Value
	strDN = GetObjectDN(strUser, "mydomain") 'NETBIOS name, do NOT include DNS extension: i.e. .com .org etc.
'	WScript.Echo("DN: " & strDN)
	Set objUser = GetObject("LDAP://" & strDN) 
	objUser.Put "msEXCHOmaAdminWirelessEnable", "7"
	objLogfile.WriteLine(objUser.Name & " disabled for mobile access")
Function GetObjectDN(strObject, strDomain)
        ' Return Type: String
        ' Returns a Distinguished Name for an Object from it's NT SAM ID.
        ' This will only function for valid object types within an NT Domain structure.
        Const ADS_NAME_INITTYPE_GC = 3
        Const ADS_NAME_TYPE_1779 = 1
        Const ADS_NAME_TYPE_NT4 = 3
        Dim objNameTranslate
        Dim strObjectDN
        On Error Resume Next : Err.Clear
        Set objNameTranslate = CreateObject("NameTranslate")
        objNameTranslate.Init ADS_NAME_INITTYPE_GC, ""
        objNameTranslate.Set ADS_NAME_TYPE_NT4, strDomain & "\" & strObject
        strObjectDN = objNameTranslate.Get(ADS_NAME_TYPE_1779)
        If Err.Number <> 0 Then  ' Make the DN Blank for a Failed Search
                strObjectDN = ""
        End If
        Set objNameTranslate = Nothing
        On Error Goto 0
        GetObjectDN = strObjectDN
End Function

Open in new window

Awarded 2009
Top Expert 2010

You can just block select the accounts in Active directory and make the change on features for them all.
I learn something new everyday..  Demazter is right..  if you bulk select and go to Exchange Tasks the option is right there..  oh well..  i like writing scripts anyway :)
Awarded 2009
Top Expert 2010

I like to do things the easy way if I at all can :-) My days of script writing are long gone!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial