Solved

Disabling owa through group policy for specific users?

Posted on 2011-03-16
10
1,706 Views
Last Modified: 2012-05-11
hey guys

any way of disabling OWA for groups of users on exchange 2007 using Group policies? I didn't want to manually disable it from the exchange management console. Any way of doing this with GP or some sort of add-in?

Thanks
Yashy
0
Comment
Question by:Yashy
  • 4
  • 3
  • 3
10 Comments
 
LVL 7

Expert Comment

by:waleeda
Comment Utility
you can create a new GPO and list the OWA URL as a restricted web site, and apply that GPO on those users
0
 
LVL 1

Author Comment

by:Yashy
Comment Utility
thanks man.

is there a script of any kind that does this?
0
 
LVL 7

Expert Comment

by:waleeda
Comment Utility
no need for script, because script will take time to run and it will slow the logon process, so better if you applied by group policy only, normally we are using the script if we dont have the option in the GPO settings
0
 
LVL 8

Expert Comment

by:GundogTrainer
Comment Utility
Do you mean you want to prevent those account from being enabled on OWA by disabling the http\OWA protocol on the Exchange features tab of a user account.

I coundnt find it when I looked for my organisation so I have a script that Enables \ disables it based on membership of an AD group. Happy to post it for you if you cant do it via GPO.
0
 
LVL 1

Author Comment

by:Yashy
Comment Utility
Yes GundogTrainer, that's what I wanted. To prevent the account from being enabled on OWA is what I want to stop them being able to use OWA. Will your script do that?

Although waleeda is mentioning that it will slow down things?

Many thanks.
0
Do email signature updates give you a headache?

Do you feel like you are constantly making changes to email signatures? Are the images not formatting how you want them to? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today.

 
LVL 1

Author Comment

by:Yashy
Comment Utility
Yes, the script would be great if you could post that. Much appreciate it.
0
 
LVL 8

Expert Comment

by:GundogTrainer
Comment Utility
Can you have a look at this previous post as the script I am using at the moment is for the mobile services not the OWA protocol - my bad !
http://www.experts-exchange.com/Programming/Languages/Q_26617753.html

I can merge it with my script in the morning so it would disable based on group membership.
0
 
LVL 7

Expert Comment

by:waleeda
Comment Utility
the GPO better than the script
because the feature already there and the script will slow down the logon process
0
 
LVL 8

Accepted Solution

by:
GundogTrainer earned 500 total points
Comment Utility
if you can find the property in a GPO then I agree that would indeed be a much better method.
As i see it the issue is not to prevent a user from accessing a specific website when logged into the domain but from preventing those domain users from using the webmail portal from anywhere with any device.

The Protocols in Exchange features are assumed to be Enabled if they are not set, I would as always suggest you test this with a couple of test accounts in there own OU to confirm it does what it should.

In summary, it enemerates all the users under a specified OU path (line 14)
If they are a member of the group (line 13) they are disabled
If they are disabled but not in the group they are enabled.
Users with no Protocol settings - it creates them as enabled and moves onto the next record.

Also, this is not a login script but would be scheduled to run regularly on a server \ admin PC.
If you comment out line 66 once tested then you could just run it with the output piped to a log file to keep an eye on what its been doing.

cscript //nologo DisableOWA.vbs >>log.txt

As ever if anyone has a better option please tell me !!!
Const ADS_PROPERTY_CLEAR  = 1 
Const ADS_PROPERTY_UPDATE = 2
Const ADS_PROPERTY_APPEND = 3
Const conIMAP4on   = "IMAP4§1§1§4§DIN_66003§0§1§0§0"
Const conPOP3on    = "POP3§1§1§4§DIN_66003§0§§§"
Const conMAPIon    = "MAPI§1§0§§§§§§"
Const conOWAoff    = "HTTP§0§1§§§§§§"
Const conOWAon     = "HTTP§1§1§§§§§§"


Const SySConUN ="adminuser@domain"
Const SySConPW ="password"
OWADisabledGroupDN="LDAP://MY-DC-SERVER/cn=DisabledOWAUsers,OU=Groups,DC=something,DC=local"
ADLDAPpath= "LDAP://MY-DC-SERVER/OU=MY User Accounts,DC=something,DC=local"


Dim arrDefaultNewUser
arrDefaultNewUser = array(conPOP3on,conIMAP4on,conOWAon)
Dim arrProtocol
Dim OWADisabledGroupDN

 set adsNS =getobject("LDAP:")
 set OWAgroup = adsns.openDsObject(OWADisabledGroupDN,SySConUN,SySConPW,0)

 SQLSYSTEMS = "<" & ADLDAPpath & ">;(&(mailnickname=*)(objectClass=user)(objectCategory=person)(homeMDB=*));adspath,distinguishedName,cn,mail,protocolSettings,mailnickname,displayname;subtree"
 Set SySConn = CreateObject("ADODB.Connection")
 Set SysCommand = CreateObject("ADODB.Command")
 SySConn.Provider = "ADSDSOObject"
 Sysconn.Open "Active Directory Provider" ,SySConUN,SySConPW
 set SysCommand.Activeconnection = SysConn
 SysCommand.commandtext = SQLSYSTEMS
 SYSCommand.Properties("Page Size")=100
 Set SySrs = SysCommand.Execute
 'wscript.echo SySrs.recordcount & " Records"

  if SySrs.recordcount >0 then
   Do While Not SySrs.EOF Or SySrs.BOF
     arrProtocol = sysrs.fields("protocolsettings")
     UpdateUser="NoChange"
     if not isarray(arrProtocol) then
     wscript.echo SetOWA(sysrs.fields("adspath"),arrDefaultNewUser) & " Set to default"
     end if

     for x=0 to ubound(arrProtocol)
      if left(arrProtocol(x),4)="HTTP" then

         if OWAgroup.ismember(sysrs.fields("adspath")) then
           'Is in the OWA group - ensure HTTP is disabled
            if arrProtocol(x)=conOWAon then 
              UpdateUser="Disable"
              arrProtocol(x)=conOWAoff
            end if
          Else
           'Not in the OWA group - make sure it is enabled
             if arrProtocol(x)=conOWAoff then 
               UpdateUser="Enable"
              arrProtocol(x)=conOWAon
            end if
         end if
       end if
     next

     If UpdateUser<>"NoChange" then
       wscript.echo UpdateUser & ":" & SetOWA(sysrs.fields("adspath"),arrProtocol) & ":" & now()
      else
       wscript.echo UpdateUser & ":" & sysrs.fields("displayname")
     end if

     SySrs.MoveNext
     Erase arrProtocol
   Loop
  end if
 SySConn.close
 Set SySConn=nothing


function SetOWA(byref RefUserADSPath,byref arrProtocolSettings)
 set adsNS =getobject("LDAP:")
 set RefUser = adsns.openDsObject(RefUserADSPath,SySConUN,SySConPW,0)
 SetOWA=refuser.cn
 RefUser.PutEx ADS_PROPERTY_UPDATE, "protocolSettings",arrProtocolSettings
 RefUser.setinfo
 set RefUser = nothing
 set adsNS = nothing
end function

Open in new window

0
 
LVL 8

Expert Comment

by:GundogTrainer
Comment Utility
Typical I found a microsoft article that shows a method of restricting access to OWA based upon the user having a specific email domain - specified by a reciepient policy, and a new HTTP virtual server.

I would have prefered to have read this article before fixing the vbscript....
http://support.microsoft.com/kb/830827
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Sometimes Outlook might have problems sending a message. There may be various causes- corrupted PST, AV scanner etc. The message, instead of going to the Sent Items folder, sits in the Outbox indefinitely. To remove it you can use a free tool cal…
Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now