Is there a way to completely cut off access to an Exchange 2010 email account right away?


I was wondering if there is a way to cut off access to an Exchange 2010 email account right away in case an employee is let go?  I noticed that even if I change the password the account and disable the access in AD (login hours to not allowed), but the employee is still connected using Outlook or webmail, that their connection stays up and the ex-employee is still able to send and receive emails, delete contacts, emails, etc.  I read some articles that say that if you move it to another DB, access will be cut off (thus a combination of that plus disabling the login and changing the password would work).  However, the access is not cut off until the end of the mailbox move and if the person has a big email box, it could mean that he or she can potentially remain logged on for hours.  Please let me know if there is a solution as I think this is a major malfunction in Exchange...

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Use disable-mailbox on the Exchange server.  This will not delete the mailbox but will disconnect it from the user account.

You can reconnect the mailbox later back to the same or another account.
Peter HutchisonSenior Network Systems SpecialistCommented:
Disable is not the best method, as it will be eventaully purged from the database. Instead open properties of the mailbox and click on Mailbox Features and disable access to MAPI, OWA, IMAP and POP3. Therefore the user can no longer can access it but the mailbox will still be on the system.
TSAdmin8Author Commented:

Thank you for your answers!
I did disable and re-enabled the account hoping it would cut the session that the user had open with Webmail but it did not (I disabled it and reenabled it an hour later but the user remained connected sending, receiving emails, and deleting several items.  He was still connected when I undeleted his emails and contacts, which made him very upset).  He was connected for over 4 hours until I moved the mailbox to another DB.  I also disabled OWA and Mapi but that also did not terminate the open session.  Exchange 2003 was awesome at terminating sessions (you could just click disconnect) but it is not apparent how to do it in 2010...


Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Try locking the account by entering the wrong password multiple times.

You could try disabling mailbox and then run Exchange Management Shell cmdlet Clean-MaildboxDatabase. This will update the status of the mailbox as disconnected.
Alexei KuznetsovMicrosoft Outlook MVPCommented:
The best results give the following three Exchange PowerShell commands:

Set-Mailbox -Identity "Terminated User" -RecipientLimits 0
Set-CASMailbox -Identity "Terminated User" -OWAEnabled:$false
Set-CASMailbox -Identity "Terminated User" -ActiveSyncEnabled:$false

Open in new window

These immediately denies user to send any emails and disables OWA/EAS in several miniutes.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.