If you want to disable access to ActiveSync – Direct Push – Oma, you can change the propertymsExchOmaAdminWirelessEnable for the user account.Here is the tab in AD exchange extensions where you would manually do it:
Note that by default this attribute is empty and all new users have access to these features.In order to disable all allowed features, you need to set the attribute to 7If you want to set specific options, you can make the changes manually and verify the setting via Adsiedit.mscHere is a Powershell script that will disable the Mobile services for all users except a list of users found in mylist.txt(based on samaccountname)
$cred = Get-Credential domainuser
$myexcludelist = gc c:mylist.txt
$myexcludelistForeach ($user in Get-QADUser -SizeLimit 5000 -SearchRoot ‘dc=domain,dc=com’ -Email *)
{
$user.SamAccountName
If ($myexcludelist -contains $user.SamAccountName)
{
Write-Host $user.SamAccountName + “exists”
}
else
{set-QADUser -Identity $user -ObjectAttributes @{msExchOmaAdminWirelessEnable=’7′} -credential $cred
}}If you need to reset the attribute to the default value, just insert an empty value ”Here is a little script to check your changes on a specific user:$user
=Get-QADUser-samaccountname testaccount-SearchRoot‘dc=domain,dc=com’–IncludedProperties(‘msExchOmaAdminWirelessEnable’)$user
.(‘msExchOmaAdminWirelessEnable’)‘ Disable all
set-QADUser
-Identity$user-ObjectAttributes @{msExchOmaAdminWirelessEnable=‘7’}
‘ Reset to default set-QADUser-Identity$user-ObjectAttributes @{msExchOmaAdminWirelessEnable=”}Update
Following a comment by Joe here below, here is the way to disable the features to users from a text file.
Get-Content e:\users.txt | %{set-QADUser-Identity$_-ObjectAttributes @{msExchOmaAdminWirelessEnable=’7′}}
[The users.txt would contain samaccountnames]
Advertisements
when I runthis script I get The object already exists. (Exception from HRESULT: 0x80071392)At :line:12 char:17+ set-QADUser <<<< -Identity $user -ObjectAttributes @{msExchOmaAdminWirelessEnable=’5’} -Credential $cred
hello,
i need to do the other way around.
can you modify you script please that ill put in the mylist.txt file users and that the script will disable their mobile services option.?
thanks for this ability ! your great!
Hi Joe,
I updated the post according to your request.
Hope it helps.
ps: please test thoroughly before implementing the changes in production.