Use the Exchange Management Shell or LDAP to get a list of quarantined mobile devices

You can use Exchange Control Panel to view the list of Exchange ActiveSync devices that are in a quarantined state.  I wanted to be able to get this list without using ECP, but I didn’t know where this information is stored: Exchange or AD?  Long story short, it is stored in AD.  Every Exchange ActiveSync partnership exists as an AD object (whose class is msExchActiveSyncDevice) located as a child object of the user object whose mailbox has the partnership.  The access state of the device is stored as an integer in the msExchDeviceAccessState attribute of the object.

To use EMS to get the list, run this command:

If you want to use LDAP to get the list, this is the corresponding search filter:


The device access state values are 1 for allowed, 2 for blocked, 3 for quarantined.

Leave a Reply

Your email address will not be published. Required fields are marked *