Script to disable Exchange ActiveSync for unauthorized users
Comments (0) By default, users have all mobile services enabled (OMA, EAS including AUTD/DP). This is a pain in my environment because only authorized users are allowed to use EAS (to ensure only approved devices procured through proper channels are used). OMA, being similar to OWA, is allowed for everyone.
I had written a batch file long ago to change the bitmask attribute for users whose mobile services are enabled for everything (0) and are not in the appropriate DL of authorized users to disable only EAS (5). It was an inefficient script that required explicit permissions for each domain, called a command-line regex tool to format the ldifde export, and was prone to errors.
This updated script accomplishes the same thing, but more efficiently. It processes all users at one time (inside a for loop) and uses implicit permissions. It even emails the results of the number of users modified. The script is customized for my environment, but you can tweak it as necessary.Â
I have five user domains, but the DLs for authorization are in one domain. I wanted it to be as dynamic as possible, but balancing that with all the extra code necessary to make every piece not rely on hard-coded information. So you need to provide mail config information, the NetBIOS domain names you want to loop through, and the dn of the groups for each user domain. The GC to search and the DC to make the change to will be determined automatically.
Download it here or copy below.
Option Explicit
Dim mailFrom, mailTo, mailSubject, mailBody, mailServer
Dim objConnection, objCommand, objRecordSet, objUser, objGC, objDomain
Dim strGCPath, strNBDomain, strdomain, arrDomains, strCount
dim strSearchFilter, strEASDL, strDomainPath
strCount = ""
'Mail config
mailFrom = Wscript.ScriptName & "@company.com"
mailTo = "user@company.com"
mailSubject = "EAS Disable Results"
mailBody = ""
mailServer = "server.company.com"
'AD connection parameters
Set objConnection = CreateObject("ADODB.Connection")
objConnection.Open "Provider=ADsDSOObject;"
Set objCommand = CreateObject("ADODB.Command")
objCommand.ActiveConnection = objConnection
'Get FQDN of a GC
Set objGC = GetObject("GC://RootDSE")
strGCPath = objGC.Get("dnsHostName")
'Query each domain and call disable subroutine
arrDomains = array("domainA", "domainB", "domainC", "domainD", "domainE")
For each strDomain in arrDomains
subOMADisable strdomain
Next
'Email results
Call subSendMail(mailFrom, mailTo, mailSubject, strCount, mailServer)
'Sub to change attribute value
Sub subOMADisable(strNBDomain)
'Get base DN of domain
Set objDomain = GetObject("LDAP://" & strNBDomain & "/RootDSE")
strDomainPath = objDomain.Get("DefaultNamingContext")
Set objDomain = Nothing
Select Case strNBDomain
Case "domainA"
strEASDL = "dn of groupA"
Case "domainB"
strEASDL = "dn of groupB"
Case "domainC"
strEASDL = "dn of groupC"
Case "domainD"
strEASDL = "dn of groupD"
Case "domainE"
strEASDL = "dn of groupE"
End Select
strSearchFilter="(&(objectcategory=user)(mailnickname=*)(homeMDB=*)(!memberof=" & strEASDL & ")(!msExchOMAAdminWirelessEnable=5))"
objCommand.CommandText = "<GC://" & strGCPath & "/" & strDomainPath & ">;" & strSearchFilter & ";distinguishedname;subtree"
Set objRecordSet = objCommand.Execute
If objRecordSet.RecordCount > 0 Then
While Not objRecordSet.EOF
Set objUser = GetObject("LDAP://" & objRecordSet.Fields("distinguishedname"))
'wscript.echo objUser.DisplayName
objUser.Put "msExchOMAAdminWirelessEnable", "5"
objUser.SetInfo
objRecordSet.MoveNext
Wend
End If
strCount = strCount & vbTAB & strNBDomain & ": " & objRecordSet.RecordCount & vbCRLF
End Sub
'Sub to send email with results
Sub subSendMail (mFrom, mTo, mSubject, mBody, mServer)
Dim objEmail
Set objEmail = CreateObject("CDO.Message")
objEmail.From = mFrom
objEmail.To = mTo
objEmail.Subject = mSubject
objEmail.Textbody = "Objects modified in each domain:" & vbCRLF &vbCRLF & mBody
objEmail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
objEmail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = mServer
objEmail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
objEmail.Configuration.Fields.Update
objEmail.Send
End Sub
'Cleanup
Set objUser = Nothing
Set objCommand = Nothing
Set objGC = Nothing
Set objConnection = Nothing
Themocracy