Active Directory and Exchange ActiveSync

wk6838
wk6838 used Ask the Experts™
on
Can anyone tell me if there is a way to control access to Exchange Active Sync for all users,

Basically, we only want this to be available to Exec level i-phone users and would like to prevent anyone else from accessing.

We have thousands of users so do not want to go into Exchnage properties of each user to disable User Initiated Synchronisation.
Can a security group be used?

Thankyou



Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Awarded 2009
Top Expert 2010

Commented:
Which version of Exchange are you using?
You can turn off mobile/webmail access in the Exchange Features tab (either in Active directory or Exchange Management Console - depending on which version you are using)

Author

Commented:
Exchange 2003 -

I understand you can turn the feature off but I want to do it quicky and not manually for each ad account?
Thanks
your only solution is to make that adjustment on all the accounts in your organization, since it was not already configured in the global settings. use admodify to make the mass change on all your users, its a breeze to use, just read through the documentation provided with the files. link is http://www.codeplex.com/admodify.

hope this helps.
Success in ‘20 With a Profitable Pricing Strategy

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Here's a script that will disable all 3 mobile services features for every user account in the domain.  You will need to manually enable the users you want to have access.

Cut-n-Paste the script into a text file with a .vbs extension.  You will need to change the Log File Path in the first line.  You also need to Find & Replace 'MYDOMAIN' with your domain name in 2 places in the script.

Also, if you prefer to use ADModify, the attribute you need to change is 'msEXCHOmaAdminWirelessEnable'.  Change it to "7" to disable all 3 mobile services features.
strLogFile = "c:\test\ChangeUserAttribute.txt"

Const ADS_SCOPE_SUBTREE = 2
Const ADS_PROPERTY_UPDATE = 2 

Set objConnection = CreateObject("ADODB.Connection")
Set objCommand =   CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objFSO = WScript.CreateObject("Scripting.FileSystemObject")
Set objLogFile = objfso.CreateTextFile(strLogFile, True)

Set objCommand.ActiveConnection = objConnection
objCommand.CommandText = _
    "Select Name,samaccountname from 'LDAP://DC=mydomain,DC=com' " _
        & "Where objectCategory ='user'"  
objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE 
Set objRecordSet = objCommand.Execute
objRecordSet.MoveFirst

Do Until objRecordSet.EOF
	strUser = objRecordSet.Fields("samaccountname").Value
	strDN = GetObjectDN(strUser, "mydomain") 'NETBIOS name, do NOT include DNS extension: i.e. .com .org etc.
'	WScript.Echo("DN: " & strDN)
	Set objUser = GetObject("LDAP://" & strDN) 
 
	objUser.Put "msEXCHOmaAdminWirelessEnable", "7"
	objUser.SetInfo
	objLogfile.WriteLine(objUser.Name & " disabled for mobile access")
    objRecordSet.MoveNext
Loop
 
Function GetObjectDN(strObject, strDomain)
        ' Return Type: String
        '
        ' Returns a Distinguished Name for an Object from it's NT SAM ID.
        ' This will only function for valid object types within an NT Domain structure.
 
        Const ADS_NAME_INITTYPE_GC = 3
        Const ADS_NAME_TYPE_1779 = 1
        Const ADS_NAME_TYPE_NT4 = 3
 
        Dim objNameTranslate
        Dim strObjectDN
 
        On Error Resume Next : Err.Clear
        Set objNameTranslate = CreateObject("NameTranslate")
 
        objNameTranslate.Init ADS_NAME_INITTYPE_GC, ""
        objNameTranslate.Set ADS_NAME_TYPE_NT4, strDomain & "\" & strObject
        strObjectDN = objNameTranslate.Get(ADS_NAME_TYPE_1779)
        If Err.Number <> 0 Then  ' Make the DN Blank for a Failed Search
                strObjectDN = ""
        End If
 
        Set objNameTranslate = Nothing
        On Error Goto 0
        GetObjectDN = strObjectDN
End Function
 

Open in new window

Awarded 2009
Top Expert 2010

Commented:
You can just block select the accounts in Active directory and make the change on features for them all.
I learn something new everyday..  Demazter is right..  if you bulk select and go to Exchange Tasks the option is right there..  oh well..  i like writing scripts anyway :)
Awarded 2009
Top Expert 2010

Commented:
I like to do things the easy way if I at all can :-) My days of script writing are long gone!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial