Solved

Disabling owa through group policy for specific users?

Posted on 2011-03-16
10
1,822 Views
Last Modified: 2012-05-11
hey guys

any way of disabling OWA for groups of users on exchange 2007 using Group policies? I didn't want to manually disable it from the exchange management console. Any way of doing this with GP or some sort of add-in?

Thanks
Yashy
0
Comment
Question by:Yashy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 3
10 Comments
 
LVL 7

Expert Comment

by:waleeda
ID: 35149506
you can create a new GPO and list the OWA URL as a restricted web site, and apply that GPO on those users
0
 
LVL 1

Author Comment

by:Yashy
ID: 35149590
thanks man.

is there a script of any kind that does this?
0
 
LVL 7

Expert Comment

by:waleeda
ID: 35149615
no need for script, because script will take time to run and it will slow the logon process, so better if you applied by group policy only, normally we are using the script if we dont have the option in the GPO settings
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 
LVL 8

Expert Comment

by:GundogTrainer
ID: 35149633
Do you mean you want to prevent those account from being enabled on OWA by disabling the http\OWA protocol on the Exchange features tab of a user account.

I coundnt find it when I looked for my organisation so I have a script that Enables \ disables it based on membership of an AD group. Happy to post it for you if you cant do it via GPO.
0
 
LVL 1

Author Comment

by:Yashy
ID: 35149726
Yes GundogTrainer, that's what I wanted. To prevent the account from being enabled on OWA is what I want to stop them being able to use OWA. Will your script do that?

Although waleeda is mentioning that it will slow down things?

Many thanks.
0
 
LVL 1

Author Comment

by:Yashy
ID: 35150136
Yes, the script would be great if you could post that. Much appreciate it.
0
 
LVL 8

Expert Comment

by:GundogTrainer
ID: 35150232
Can you have a look at this previous post as the script I am using at the moment is for the mobile services not the OWA protocol - my bad !
http://www.experts-exchange.com/Programming/Languages/Q_26617753.html

I can merge it with my script in the morning so it would disable based on group membership.
0
 
LVL 7

Expert Comment

by:waleeda
ID: 35150480
the GPO better than the script
because the feature already there and the script will slow down the logon process
0
 
LVL 8

Accepted Solution

by:
GundogTrainer earned 500 total points
ID: 35156012
if you can find the property in a GPO then I agree that would indeed be a much better method.
As i see it the issue is not to prevent a user from accessing a specific website when logged into the domain but from preventing those domain users from using the webmail portal from anywhere with any device.

The Protocols in Exchange features are assumed to be Enabled if they are not set, I would as always suggest you test this with a couple of test accounts in there own OU to confirm it does what it should.

In summary, it enemerates all the users under a specified OU path (line 14)
If they are a member of the group (line 13) they are disabled
If they are disabled but not in the group they are enabled.
Users with no Protocol settings - it creates them as enabled and moves onto the next record.

Also, this is not a login script but would be scheduled to run regularly on a server \ admin PC.
If you comment out line 66 once tested then you could just run it with the output piped to a log file to keep an eye on what its been doing.

cscript //nologo DisableOWA.vbs >>log.txt

As ever if anyone has a better option please tell me !!!
Const ADS_PROPERTY_CLEAR  = 1 
Const ADS_PROPERTY_UPDATE = 2
Const ADS_PROPERTY_APPEND = 3
Const conIMAP4on   = "IMAP4§1§1§4§DIN_66003§0§1§0§0"
Const conPOP3on    = "POP3§1§1§4§DIN_66003§0§§§"
Const conMAPIon    = "MAPI§1§0§§§§§§"
Const conOWAoff    = "HTTP§0§1§§§§§§"
Const conOWAon     = "HTTP§1§1§§§§§§"


Const SySConUN ="adminuser@domain"
Const SySConPW ="password"
OWADisabledGroupDN="LDAP://MY-DC-SERVER/cn=DisabledOWAUsers,OU=Groups,DC=something,DC=local"
ADLDAPpath= "LDAP://MY-DC-SERVER/OU=MY User Accounts,DC=something,DC=local"


Dim arrDefaultNewUser
arrDefaultNewUser = array(conPOP3on,conIMAP4on,conOWAon)
Dim arrProtocol
Dim OWADisabledGroupDN

 set adsNS =getobject("LDAP:")
 set OWAgroup = adsns.openDsObject(OWADisabledGroupDN,SySConUN,SySConPW,0)

 SQLSYSTEMS = "<" & ADLDAPpath & ">;(&(mailnickname=*)(objectClass=user)(objectCategory=person)(homeMDB=*));adspath,distinguishedName,cn,mail,protocolSettings,mailnickname,displayname;subtree"
 Set SySConn = CreateObject("ADODB.Connection")
 Set SysCommand = CreateObject("ADODB.Command")
 SySConn.Provider = "ADSDSOObject"
 Sysconn.Open "Active Directory Provider" ,SySConUN,SySConPW
 set SysCommand.Activeconnection = SysConn
 SysCommand.commandtext = SQLSYSTEMS
 SYSCommand.Properties("Page Size")=100
 Set SySrs = SysCommand.Execute
 'wscript.echo SySrs.recordcount & " Records"

  if SySrs.recordcount >0 then
   Do While Not SySrs.EOF Or SySrs.BOF
     arrProtocol = sysrs.fields("protocolsettings")
     UpdateUser="NoChange"
     if not isarray(arrProtocol) then
     wscript.echo SetOWA(sysrs.fields("adspath"),arrDefaultNewUser) & " Set to default"
     end if

     for x=0 to ubound(arrProtocol)
      if left(arrProtocol(x),4)="HTTP" then

         if OWAgroup.ismember(sysrs.fields("adspath")) then
           'Is in the OWA group - ensure HTTP is disabled
            if arrProtocol(x)=conOWAon then 
              UpdateUser="Disable"
              arrProtocol(x)=conOWAoff
            end if
          Else
           'Not in the OWA group - make sure it is enabled
             if arrProtocol(x)=conOWAoff then 
               UpdateUser="Enable"
              arrProtocol(x)=conOWAon
            end if
         end if
       end if
     next

     If UpdateUser<>"NoChange" then
       wscript.echo UpdateUser & ":" & SetOWA(sysrs.fields("adspath"),arrProtocol) & ":" & now()
      else
       wscript.echo UpdateUser & ":" & sysrs.fields("displayname")
     end if

     SySrs.MoveNext
     Erase arrProtocol
   Loop
  end if
 SySConn.close
 Set SySConn=nothing


function SetOWA(byref RefUserADSPath,byref arrProtocolSettings)
 set adsNS =getobject("LDAP:")
 set RefUser = adsns.openDsObject(RefUserADSPath,SySConUN,SySConPW,0)
 SetOWA=refuser.cn
 RefUser.PutEx ADS_PROPERTY_UPDATE, "protocolSettings",arrProtocolSettings
 RefUser.setinfo
 set RefUser = nothing
 set adsNS = nothing
end function

Open in new window

0
 
LVL 8

Expert Comment

by:GundogTrainer
ID: 35158579
Typical I found a microsoft article that shows a method of restricting access to OWA based upon the user having a specific email domain - specified by a reciepient policy, and a new HTTP virtual server.

I would have prefered to have read this article before fixing the vbscript....
http://support.microsoft.com/kb/830827
0

Featured Post

MS Dynamics Made Instantly Simpler

Make Your Microsoft Dynamics Investment Count  & Drastically Decrease Training Time by Providing Intuitive Step-By-Step WalkThru Tutorials.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you have clients or friends from around the world, it becomes a challenge to arrange a meeting or effectively manage your time. This is where Outlook's capability to show 2 time zones in one calendar comes in handy.
This article will help to fix the below error for MS Exchange server 2010 I. Out Of office not working II. Certificate error "name on the security certificate is invalid or does not match the name of the site" III. Make Internal URLs and External…
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question