Disabling owa through group policy for specific users?

hey guys

any way of disabling OWA for groups of users on exchange 2007 using Group policies? I didn't want to manually disable it from the exchange management console. Any way of doing this with GP or some sort of add-in?

Thanks
Yashy
LVL 1
YashyAsked:
Who is Participating?
 
GundogTrainerConnect With a Mentor Commented:
if you can find the property in a GPO then I agree that would indeed be a much better method.
As i see it the issue is not to prevent a user from accessing a specific website when logged into the domain but from preventing those domain users from using the webmail portal from anywhere with any device.

The Protocols in Exchange features are assumed to be Enabled if they are not set, I would as always suggest you test this with a couple of test accounts in there own OU to confirm it does what it should.

In summary, it enemerates all the users under a specified OU path (line 14)
If they are a member of the group (line 13) they are disabled
If they are disabled but not in the group they are enabled.
Users with no Protocol settings - it creates them as enabled and moves onto the next record.

Also, this is not a login script but would be scheduled to run regularly on a server \ admin PC.
If you comment out line 66 once tested then you could just run it with the output piped to a log file to keep an eye on what its been doing.

cscript //nologo DisableOWA.vbs >>log.txt

As ever if anyone has a better option please tell me !!!
Const ADS_PROPERTY_CLEAR  = 1 
Const ADS_PROPERTY_UPDATE = 2
Const ADS_PROPERTY_APPEND = 3
Const conIMAP4on   = "IMAP4§1§1§4§DIN_66003§0§1§0§0"
Const conPOP3on    = "POP3§1§1§4§DIN_66003§0§§§"
Const conMAPIon    = "MAPI§1§0§§§§§§"
Const conOWAoff    = "HTTP§0§1§§§§§§"
Const conOWAon     = "HTTP§1§1§§§§§§"


Const SySConUN ="adminuser@domain"
Const SySConPW ="password"
OWADisabledGroupDN="LDAP://MY-DC-SERVER/cn=DisabledOWAUsers,OU=Groups,DC=something,DC=local"
ADLDAPpath= "LDAP://MY-DC-SERVER/OU=MY User Accounts,DC=something,DC=local"


Dim arrDefaultNewUser
arrDefaultNewUser = array(conPOP3on,conIMAP4on,conOWAon)
Dim arrProtocol
Dim OWADisabledGroupDN

 set adsNS =getobject("LDAP:")
 set OWAgroup = adsns.openDsObject(OWADisabledGroupDN,SySConUN,SySConPW,0)

 SQLSYSTEMS = "<" & ADLDAPpath & ">;(&(mailnickname=*)(objectClass=user)(objectCategory=person)(homeMDB=*));adspath,distinguishedName,cn,mail,protocolSettings,mailnickname,displayname;subtree"
 Set SySConn = CreateObject("ADODB.Connection")
 Set SysCommand = CreateObject("ADODB.Command")
 SySConn.Provider = "ADSDSOObject"
 Sysconn.Open "Active Directory Provider" ,SySConUN,SySConPW
 set SysCommand.Activeconnection = SysConn
 SysCommand.commandtext = SQLSYSTEMS
 SYSCommand.Properties("Page Size")=100
 Set SySrs = SysCommand.Execute
 'wscript.echo SySrs.recordcount & " Records"

  if SySrs.recordcount >0 then
   Do While Not SySrs.EOF Or SySrs.BOF
     arrProtocol = sysrs.fields("protocolsettings")
     UpdateUser="NoChange"
     if not isarray(arrProtocol) then
     wscript.echo SetOWA(sysrs.fields("adspath"),arrDefaultNewUser) & " Set to default"
     end if

     for x=0 to ubound(arrProtocol)
      if left(arrProtocol(x),4)="HTTP" then

         if OWAgroup.ismember(sysrs.fields("adspath")) then
           'Is in the OWA group - ensure HTTP is disabled
            if arrProtocol(x)=conOWAon then 
              UpdateUser="Disable"
              arrProtocol(x)=conOWAoff
            end if
          Else
           'Not in the OWA group - make sure it is enabled
             if arrProtocol(x)=conOWAoff then 
               UpdateUser="Enable"
              arrProtocol(x)=conOWAon
            end if
         end if
       end if
     next

     If UpdateUser<>"NoChange" then
       wscript.echo UpdateUser & ":" & SetOWA(sysrs.fields("adspath"),arrProtocol) & ":" & now()
      else
       wscript.echo UpdateUser & ":" & sysrs.fields("displayname")
     end if

     SySrs.MoveNext
     Erase arrProtocol
   Loop
  end if
 SySConn.close
 Set SySConn=nothing


function SetOWA(byref RefUserADSPath,byref arrProtocolSettings)
 set adsNS =getobject("LDAP:")
 set RefUser = adsns.openDsObject(RefUserADSPath,SySConUN,SySConPW,0)
 SetOWA=refuser.cn
 RefUser.PutEx ADS_PROPERTY_UPDATE, "protocolSettings",arrProtocolSettings
 RefUser.setinfo
 set RefUser = nothing
 set adsNS = nothing
end function

Open in new window

0
 
waleedaCommented:
you can create a new GPO and list the OWA URL as a restricted web site, and apply that GPO on those users
0
 
YashyAuthor Commented:
thanks man.

is there a script of any kind that does this?
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
waleedaCommented:
no need for script, because script will take time to run and it will slow the logon process, so better if you applied by group policy only, normally we are using the script if we dont have the option in the GPO settings
0
 
GundogTrainerCommented:
Do you mean you want to prevent those account from being enabled on OWA by disabling the http\OWA protocol on the Exchange features tab of a user account.

I coundnt find it when I looked for my organisation so I have a script that Enables \ disables it based on membership of an AD group. Happy to post it for you if you cant do it via GPO.
0
 
YashyAuthor Commented:
Yes GundogTrainer, that's what I wanted. To prevent the account from being enabled on OWA is what I want to stop them being able to use OWA. Will your script do that?

Although waleeda is mentioning that it will slow down things?

Many thanks.
0
 
YashyAuthor Commented:
Yes, the script would be great if you could post that. Much appreciate it.
0
 
GundogTrainerCommented:
Can you have a look at this previous post as the script I am using at the moment is for the mobile services not the OWA protocol - my bad !
http://www.experts-exchange.com/Programming/Languages/Q_26617753.html

I can merge it with my script in the morning so it would disable based on group membership.
0
 
waleedaCommented:
the GPO better than the script
because the feature already there and the script will slow down the logon process
0
 
GundogTrainerCommented:
Typical I found a microsoft article that shows a method of restricting access to OWA based upon the user having a specific email domain - specified by a reciepient policy, and a new HTTP virtual server.

I would have prefered to have read this article before fixing the vbscript....
http://support.microsoft.com/kb/830827
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.