[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Disabling owa through group policy for specific users?

Posted on 2011-03-16
10
Medium Priority
?
1,904 Views
Last Modified: 2012-05-11
hey guys

any way of disabling OWA for groups of users on exchange 2007 using Group policies? I didn't want to manually disable it from the exchange management console. Any way of doing this with GP or some sort of add-in?

Thanks
Yashy
0
Comment
Question by:Yashy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 3
10 Comments
 
LVL 7

Expert Comment

by:waleeda
ID: 35149506
you can create a new GPO and list the OWA URL as a restricted web site, and apply that GPO on those users
0
 
LVL 1

Author Comment

by:Yashy
ID: 35149590
thanks man.

is there a script of any kind that does this?
0
 
LVL 7

Expert Comment

by:waleeda
ID: 35149615
no need for script, because script will take time to run and it will slow the logon process, so better if you applied by group policy only, normally we are using the script if we dont have the option in the GPO settings
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 8

Expert Comment

by:GundogTrainer
ID: 35149633
Do you mean you want to prevent those account from being enabled on OWA by disabling the http\OWA protocol on the Exchange features tab of a user account.

I coundnt find it when I looked for my organisation so I have a script that Enables \ disables it based on membership of an AD group. Happy to post it for you if you cant do it via GPO.
0
 
LVL 1

Author Comment

by:Yashy
ID: 35149726
Yes GundogTrainer, that's what I wanted. To prevent the account from being enabled on OWA is what I want to stop them being able to use OWA. Will your script do that?

Although waleeda is mentioning that it will slow down things?

Many thanks.
0
 
LVL 1

Author Comment

by:Yashy
ID: 35150136
Yes, the script would be great if you could post that. Much appreciate it.
0
 
LVL 8

Expert Comment

by:GundogTrainer
ID: 35150232
Can you have a look at this previous post as the script I am using at the moment is for the mobile services not the OWA protocol - my bad !
http://www.experts-exchange.com/Programming/Languages/Q_26617753.html

I can merge it with my script in the morning so it would disable based on group membership.
0
 
LVL 7

Expert Comment

by:waleeda
ID: 35150480
the GPO better than the script
because the feature already there and the script will slow down the logon process
0
 
LVL 8

Accepted Solution

by:
GundogTrainer earned 2000 total points
ID: 35156012
if you can find the property in a GPO then I agree that would indeed be a much better method.
As i see it the issue is not to prevent a user from accessing a specific website when logged into the domain but from preventing those domain users from using the webmail portal from anywhere with any device.

The Protocols in Exchange features are assumed to be Enabled if they are not set, I would as always suggest you test this with a couple of test accounts in there own OU to confirm it does what it should.

In summary, it enemerates all the users under a specified OU path (line 14)
If they are a member of the group (line 13) they are disabled
If they are disabled but not in the group they are enabled.
Users with no Protocol settings - it creates them as enabled and moves onto the next record.

Also, this is not a login script but would be scheduled to run regularly on a server \ admin PC.
If you comment out line 66 once tested then you could just run it with the output piped to a log file to keep an eye on what its been doing.

cscript //nologo DisableOWA.vbs >>log.txt

As ever if anyone has a better option please tell me !!!
Const ADS_PROPERTY_CLEAR  = 1 
Const ADS_PROPERTY_UPDATE = 2
Const ADS_PROPERTY_APPEND = 3
Const conIMAP4on   = "IMAP4§1§1§4§DIN_66003§0§1§0§0"
Const conPOP3on    = "POP3§1§1§4§DIN_66003§0§§§"
Const conMAPIon    = "MAPI§1§0§§§§§§"
Const conOWAoff    = "HTTP§0§1§§§§§§"
Const conOWAon     = "HTTP§1§1§§§§§§"


Const SySConUN ="adminuser@domain"
Const SySConPW ="password"
OWADisabledGroupDN="LDAP://MY-DC-SERVER/cn=DisabledOWAUsers,OU=Groups,DC=something,DC=local"
ADLDAPpath= "LDAP://MY-DC-SERVER/OU=MY User Accounts,DC=something,DC=local"


Dim arrDefaultNewUser
arrDefaultNewUser = array(conPOP3on,conIMAP4on,conOWAon)
Dim arrProtocol
Dim OWADisabledGroupDN

 set adsNS =getobject("LDAP:")
 set OWAgroup = adsns.openDsObject(OWADisabledGroupDN,SySConUN,SySConPW,0)

 SQLSYSTEMS = "<" & ADLDAPpath & ">;(&(mailnickname=*)(objectClass=user)(objectCategory=person)(homeMDB=*));adspath,distinguishedName,cn,mail,protocolSettings,mailnickname,displayname;subtree"
 Set SySConn = CreateObject("ADODB.Connection")
 Set SysCommand = CreateObject("ADODB.Command")
 SySConn.Provider = "ADSDSOObject"
 Sysconn.Open "Active Directory Provider" ,SySConUN,SySConPW
 set SysCommand.Activeconnection = SysConn
 SysCommand.commandtext = SQLSYSTEMS
 SYSCommand.Properties("Page Size")=100
 Set SySrs = SysCommand.Execute
 'wscript.echo SySrs.recordcount & " Records"

  if SySrs.recordcount >0 then
   Do While Not SySrs.EOF Or SySrs.BOF
     arrProtocol = sysrs.fields("protocolsettings")
     UpdateUser="NoChange"
     if not isarray(arrProtocol) then
     wscript.echo SetOWA(sysrs.fields("adspath"),arrDefaultNewUser) & " Set to default"
     end if

     for x=0 to ubound(arrProtocol)
      if left(arrProtocol(x),4)="HTTP" then

         if OWAgroup.ismember(sysrs.fields("adspath")) then
           'Is in the OWA group - ensure HTTP is disabled
            if arrProtocol(x)=conOWAon then 
              UpdateUser="Disable"
              arrProtocol(x)=conOWAoff
            end if
          Else
           'Not in the OWA group - make sure it is enabled
             if arrProtocol(x)=conOWAoff then 
               UpdateUser="Enable"
              arrProtocol(x)=conOWAon
            end if
         end if
       end if
     next

     If UpdateUser<>"NoChange" then
       wscript.echo UpdateUser & ":" & SetOWA(sysrs.fields("adspath"),arrProtocol) & ":" & now()
      else
       wscript.echo UpdateUser & ":" & sysrs.fields("displayname")
     end if

     SySrs.MoveNext
     Erase arrProtocol
   Loop
  end if
 SySConn.close
 Set SySConn=nothing


function SetOWA(byref RefUserADSPath,byref arrProtocolSettings)
 set adsNS =getobject("LDAP:")
 set RefUser = adsns.openDsObject(RefUserADSPath,SySConUN,SySConPW,0)
 SetOWA=refuser.cn
 RefUser.PutEx ADS_PROPERTY_UPDATE, "protocolSettings",arrProtocolSettings
 RefUser.setinfo
 set RefUser = nothing
 set adsNS = nothing
end function

Open in new window

0
 
LVL 8

Expert Comment

by:GundogTrainer
ID: 35158579
Typical I found a microsoft article that shows a method of restricting access to OWA based upon the user having a specific email domain - specified by a reciepient policy, and a new HTTP virtual server.

I would have prefered to have read this article before fixing the vbscript....
http://support.microsoft.com/kb/830827
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Know the reasons and solutions to move/import EDB to New Exchange Server. Also, find out how to recover an Exchange .edb file and to restore the file back.
The core idea of this article is to make you acquainted with the best way in which you can export Exchange mailbox to PST format.
CodeTwo Sync for iCloud (http://www.codetwo.com/sync-for-icloud?sts=6554) automatically synchronizes your Outlook 2016, 2013, 2010 or 2007 folders with iCloud folders available via iCloud Control Panel. This lets you automatically sync them with…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…
Suggested Courses

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question