• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 146
  • Last Modified:

Disable ActiveSync

I trying to device a way to disable ActiveSync for all users who aren't members of the ActiveSync Allowed Security group.  I can run the below to enable disable it based on group membership but how can I disbale everyone except for those who are members of this secuirty group?


$activesync=Get-ADGroupMember "ActiveSync Allowed" -Recursive | Get-ADUser -Properties mail
foreach($member in $activesync){set-CASMailbox -Identity $member.Name -ActiveSyncEnabled $false -ErrorAction SilentContine -WarningAction SilentlyContinue


Is there anyway to disable activesync as a default for any newly created users.  I know there use to be a way to accomplish this in previous versions of exchange if I'm not mistaken but doesn't see possible in Exchange 2010.
0
georgedschneider
Asked:
georgedschneider
  • 3
  • 2
1 Solution
 
Simon Butler (Sembee)ConsultantCommented:
There has never been a way to disable ActiveSync by default. It has always required disabling afterwards.

To answer your specific question, the best way is to disable everyone, then enable those that need access. Do it out of hours so if the change is cached it has limited impact.

Alas for new users you will need to disable them manually or start using scripts to create users instead, where the service can be disabled as part of provisioning.

As a further safeguard, setup ActiveSync device policies. Quarantine or block every connection attempt until you allow it. Loads of scripts around which will approve everything that is already connected.
You could then write a script to approve devices belonging to members of the group and run it at regular intervals.

Simon.
0
 
georgedschneiderAuthor Commented:
Is there not a way to write the script where if user is not a member of group ActiveSync Allowed then disbale?
0
 
Simon Butler (Sembee)ConsultantCommented:
0
 
georgedschneiderAuthor Commented:
If activesync is disabled then reenabled minutes after what will the end user expirence on their device?  Will mailflow just stop or will  they see a popup.  Will they lose their setup?
0
 
Simon Butler (Sembee)ConsultantCommented:
It can take some hours for ActiveSync being disabled to actually take effect, because of the way ActiveSync works. The only way to force it is to restart IIS.
Therefore if you disable it and then enable it, then nothing should happen on the clients. If a client does happen to connect in that window, then nothing will happen on the device.

Simon.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now