Hello,
I've written up a script to disable someones mail/activesync in the event an associate is terminated immediately. Based on the KB articles here:
http://blogs.technet.com/b/messaging_with_communications/archive/2012/06/26/activesync-disabled-accounts-and-devices-continuing-to-sync.aspx
and
http://blogs.technet.com/b/messaging_with_communications/archive/2012/06/27/part-ii-outlook-amp-owa-disabled-accounts-and-users-still-being-able-to-access.aspx
the script is designed to prompt the admin running it for the username. It then displays the name of the user for validation. It then runs through the series of commands to disable their access via OWA/etc. This part I have down. It
is the next part that I'm a bit iffy on.
There is a possibility that the person may have more than 1 mobile device attached to their account. This particular line of code is where I'm having trouble with. Typically when you check someones mobile deviceid attached to their account, it
outputs as such:
APPLd1934j234l23 JALH123hl1dfha12lKdSHaK234.
I'm assuming both entries must be entered into the blocked device property in order to insure their device is blocked out.
#Validates that the end user has a mobile device
$VerifyMobile = Get-ActiveSyncDeviceStatistics -Mailbox:"$Username" | Select-Object -ExpandProperty deviceid
$DeviceID = Get-ActiveSyncDeviceStatistics –Mailbox "$Username" | Select-Object -ExpandProperty deviceid
#If no mobile device is detected, displays that information and exists the script.
if ($VerifyMobile -eq $null){
[System.Windows.Forms.MessageBox]::Show("No Mobile Device.","Exiting")
exit
}
#If mobile devices are detected, they are blocked.
else {
[System.Windows.Forms.MessageBox]::Show("A mobile device has been found and blocked.","Exiting")foreach($entry in $DeviceID){
Set-CASMailbox -Identity "$Username" -ActiveSyncBlockedDeviceIDs "<DeviceID_1>,<DeviceID_2>"
}
Set-CASMailbox -Identity "$Username" -ActiveSyncEnabled $false
Full script below.
#The following script is to be used on an associate who's account must be terminated immediately to prevent them from accessing mail on their mobile
#device as well as on OWA/Outlook.
#Imports Active Directory, Exchange Powershell Commandlets and loads a remote powershell session.
Import-Module ActiveDirectory
add-pssnapin Microsoft.Exchange.Management.PowerShell.E2010
. $env:ExchangeInstallPath\bin\RemoteExchange.ps1
Connect-ExchangeServer -auto
#Declares Variables
$Username = $null
$DeviceID = $null
$UNConfirm = $null
$MobileConfirm = $null
$DisplayName = $null
$DN = $null
$VerifyMobile = $null
$Email = $null
$LogFile = "C:\Scripts\DisableMail+Activesync.txt"
Start-Transcript -Path "C:\Scripts\DisableMail+Activesync.txt"
#Loads Assemblies required for prompts.
[System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") | Out-Null
[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic') | Out-Null
#Provides an initial warning of the scripts intentions.
[System.Windows.Forms.MessageBox]::Show("The following script will insure that a user who's account has just been disabled in AD will not be able to use email via webmail or their mobile device.","Disable Access to Mail")
#Loop prompting for username and verfication of username.
do {
$Username = [Microsoft.VisualBasic.Interaction]::InputBox("Enter the associates username:", "Username")
$DisplayName = Get-ADUser -Identity $Username
$DN = $DisplayName.Name
#If propmt is blank, script exists.
if(!$Username)
{
[System.Windows.Forms.MessageBox]::Show("No name entered. Exiting script.","Blank entry")
exit
}
#Prompts user for validation that the correct person is listed.
$UNConfirm = [System.Windows.Forms.MessageBox]::Show("Is this the correct user? $DN ", "Verify User" , 4)
} until ($UNConfirm -eq "YES" )
#Disables all Mailbox features preventing mail access.
Set-CASMailbox -Identity "$Username" -OwaEnabled $false
Set-CASMailbox -Identity "$Username" -EwsEnabled $false
Set-CASMailbox -Identity "$Username" -EcpEnabled $false
Set-CASMailbox -Identity "$Username" -MapiEnabled $false
Set-CASMailbox -Identity "$Username" -MapiBlockOutlookRpcHttp $true
Set-CASMailbox -Identity "$Username" -EwsAllowMacOutlook $false
Set-CASMailbox -Identity "$Username" -EwsAllowOutlook $false
Set-Mailbox -Identity "$Username" -RecipientLimits 0
#Validates that the end user has a mobile device
$VerifyMobile = Get-ActiveSyncDeviceStatistics -Mailbox:"$Username" | Select-Object -ExpandProperty deviceid
$DeviceID = Get-ActiveSyncDeviceStatistics –Mailbox "$Username" | Select-Object -ExpandProperty deviceid
#If no mobile device is detected, displays that information and exists the script.
if ($VerifyMobile -eq $null){
[System.Windows.Forms.MessageBox]::Show("No Mobile Device.","Exiting")
exit
}
#If mobile devices are detected, they are blocked.
else {
[System.Windows.Forms.MessageBox]::Show("A mobile device has been found and blocked.","Exiting")
foreach($entry in $DeviceID){
Set-CASMailbox -Identity "$Username" -ActiveSyncBlockedDeviceIDs "<DeviceID_1>,<DeviceID_2>"
Set-CASMailbox -Identity "$Username" -ActiveSyncEnabled $false
}
}
#Requests an email address to send a log of the actions to.
$Email = [Microsoft.VisualBasic.Interaction]::InputBox("Enter your email address:", "Send Email with Log")
#Writes to text file the name of the associate who was terminated.
Echo "Username:"
Write-Output $DN >> c:\Scripts\DisableMail+Activesync.txt
#Validates if a mobile device was disabled and in this case if not, writes to output no mobile device was disabled.
if ($VerifyMobile -eq $null){
echo "No mobile device." >> C:\Scripts\DisableMail+Activesync.txt
}
#Writes to output the mobile devices which were disabled.
else{
echo "Mobile Device:"
Write-Output $DeviceID >> C:\Scripts\DisableMail+Activesync.txt
}
Stop-Transcript
Email the log file
$emailFrom = "email@domain.com"
$emailTo = $Email
$subject = "Disable OWA/Activesync for terminated user"
$content = Get-Content $LogFile | ForEach-Object {$_.Split("`r`n")}
$body = [string]::Join("`r`n",$content)
$smtpServer = "mailserver.domain.com"
$smtp = new-object Net.Mail.SmtpClient($smtpServer)
$smtp.Send($emailFrom, $emailTo, $subject, $body)
Clear-Content C:\Scripts\DisableMail+Activesync.txt