Solved

Disabling owa through group policy for specific users?

Posted on 2011-03-16
10
1,742 Views
Last Modified: 2012-05-11
hey guys

any way of disabling OWA for groups of users on exchange 2007 using Group policies? I didn't want to manually disable it from the exchange management console. Any way of doing this with GP or some sort of add-in?

Thanks
Yashy
0
Comment
Question by:Yashy
  • 4
  • 3
  • 3
10 Comments
 
LVL 7

Expert Comment

by:waleeda
ID: 35149506
you can create a new GPO and list the OWA URL as a restricted web site, and apply that GPO on those users
0
 
LVL 1

Author Comment

by:Yashy
ID: 35149590
thanks man.

is there a script of any kind that does this?
0
 
LVL 7

Expert Comment

by:waleeda
ID: 35149615
no need for script, because script will take time to run and it will slow the logon process, so better if you applied by group policy only, normally we are using the script if we dont have the option in the GPO settings
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 
LVL 8

Expert Comment

by:GundogTrainer
ID: 35149633
Do you mean you want to prevent those account from being enabled on OWA by disabling the http\OWA protocol on the Exchange features tab of a user account.

I coundnt find it when I looked for my organisation so I have a script that Enables \ disables it based on membership of an AD group. Happy to post it for you if you cant do it via GPO.
0
 
LVL 1

Author Comment

by:Yashy
ID: 35149726
Yes GundogTrainer, that's what I wanted. To prevent the account from being enabled on OWA is what I want to stop them being able to use OWA. Will your script do that?

Although waleeda is mentioning that it will slow down things?

Many thanks.
0
 
LVL 1

Author Comment

by:Yashy
ID: 35150136
Yes, the script would be great if you could post that. Much appreciate it.
0
 
LVL 8

Expert Comment

by:GundogTrainer
ID: 35150232
Can you have a look at this previous post as the script I am using at the moment is for the mobile services not the OWA protocol - my bad !
http://www.experts-exchange.com/Programming/Languages/Q_26617753.html

I can merge it with my script in the morning so it would disable based on group membership.
0
 
LVL 7

Expert Comment

by:waleeda
ID: 35150480
the GPO better than the script
because the feature already there and the script will slow down the logon process
0
 
LVL 8

Accepted Solution

by:
GundogTrainer earned 500 total points
ID: 35156012
if you can find the property in a GPO then I agree that would indeed be a much better method.
As i see it the issue is not to prevent a user from accessing a specific website when logged into the domain but from preventing those domain users from using the webmail portal from anywhere with any device.

The Protocols in Exchange features are assumed to be Enabled if they are not set, I would as always suggest you test this with a couple of test accounts in there own OU to confirm it does what it should.

In summary, it enemerates all the users under a specified OU path (line 14)
If they are a member of the group (line 13) they are disabled
If they are disabled but not in the group they are enabled.
Users with no Protocol settings - it creates them as enabled and moves onto the next record.

Also, this is not a login script but would be scheduled to run regularly on a server \ admin PC.
If you comment out line 66 once tested then you could just run it with the output piped to a log file to keep an eye on what its been doing.

cscript //nologo DisableOWA.vbs >>log.txt

As ever if anyone has a better option please tell me !!!
Const ADS_PROPERTY_CLEAR  = 1 
Const ADS_PROPERTY_UPDATE = 2
Const ADS_PROPERTY_APPEND = 3
Const conIMAP4on   = "IMAP4§1§1§4§DIN_66003§0§1§0§0"
Const conPOP3on    = "POP3§1§1§4§DIN_66003§0§§§"
Const conMAPIon    = "MAPI§1§0§§§§§§"
Const conOWAoff    = "HTTP§0§1§§§§§§"
Const conOWAon     = "HTTP§1§1§§§§§§"


Const SySConUN ="adminuser@domain"
Const SySConPW ="password"
OWADisabledGroupDN="LDAP://MY-DC-SERVER/cn=DisabledOWAUsers,OU=Groups,DC=something,DC=local"
ADLDAPpath= "LDAP://MY-DC-SERVER/OU=MY User Accounts,DC=something,DC=local"


Dim arrDefaultNewUser
arrDefaultNewUser = array(conPOP3on,conIMAP4on,conOWAon)
Dim arrProtocol
Dim OWADisabledGroupDN

 set adsNS =getobject("LDAP:")
 set OWAgroup = adsns.openDsObject(OWADisabledGroupDN,SySConUN,SySConPW,0)

 SQLSYSTEMS = "<" & ADLDAPpath & ">;(&(mailnickname=*)(objectClass=user)(objectCategory=person)(homeMDB=*));adspath,distinguishedName,cn,mail,protocolSettings,mailnickname,displayname;subtree"
 Set SySConn = CreateObject("ADODB.Connection")
 Set SysCommand = CreateObject("ADODB.Command")
 SySConn.Provider = "ADSDSOObject"
 Sysconn.Open "Active Directory Provider" ,SySConUN,SySConPW
 set SysCommand.Activeconnection = SysConn
 SysCommand.commandtext = SQLSYSTEMS
 SYSCommand.Properties("Page Size")=100
 Set SySrs = SysCommand.Execute
 'wscript.echo SySrs.recordcount & " Records"

  if SySrs.recordcount >0 then
   Do While Not SySrs.EOF Or SySrs.BOF
     arrProtocol = sysrs.fields("protocolsettings")
     UpdateUser="NoChange"
     if not isarray(arrProtocol) then
     wscript.echo SetOWA(sysrs.fields("adspath"),arrDefaultNewUser) & " Set to default"
     end if

     for x=0 to ubound(arrProtocol)
      if left(arrProtocol(x),4)="HTTP" then

         if OWAgroup.ismember(sysrs.fields("adspath")) then
           'Is in the OWA group - ensure HTTP is disabled
            if arrProtocol(x)=conOWAon then 
              UpdateUser="Disable"
              arrProtocol(x)=conOWAoff
            end if
          Else
           'Not in the OWA group - make sure it is enabled
             if arrProtocol(x)=conOWAoff then 
               UpdateUser="Enable"
              arrProtocol(x)=conOWAon
            end if
         end if
       end if
     next

     If UpdateUser<>"NoChange" then
       wscript.echo UpdateUser & ":" & SetOWA(sysrs.fields("adspath"),arrProtocol) & ":" & now()
      else
       wscript.echo UpdateUser & ":" & sysrs.fields("displayname")
     end if

     SySrs.MoveNext
     Erase arrProtocol
   Loop
  end if
 SySConn.close
 Set SySConn=nothing


function SetOWA(byref RefUserADSPath,byref arrProtocolSettings)
 set adsNS =getobject("LDAP:")
 set RefUser = adsns.openDsObject(RefUserADSPath,SySConUN,SySConPW,0)
 SetOWA=refuser.cn
 RefUser.PutEx ADS_PROPERTY_UPDATE, "protocolSettings",arrProtocolSettings
 RefUser.setinfo
 set RefUser = nothing
 set adsNS = nothing
end function

Open in new window

0
 
LVL 8

Expert Comment

by:GundogTrainer
ID: 35158579
Typical I found a microsoft article that shows a method of restricting access to OWA based upon the user having a specific email domain - specified by a reciepient policy, and a new HTTP virtual server.

I would have prefered to have read this article before fixing the vbscript....
http://support.microsoft.com/kb/830827
0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you don't know how to downgrade, my instructions below should be helpful.
Scam emails are a huge burden for many businesses. Spotting one is not always easy. Follow our tips to identify if an email you receive is a scam.
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
how to add IIS SMTP to handle application/Scanner relays into office 365.

815 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now