Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I was asked to set up an Exchange Activesync mobile gateway. That's done. It's a separat eExchange 2003 front-end server configured for SSL, and I've put an off-domain ISA server in front of it. Now I'm being asked to limit which users can connect to it.

By default an Exchange front-end server allows any user who has a mail account to connect to the front -end server. So I'm looking at the permissions on the various IIS sites/apps on the server, but I know that it's easy to break Exchange Front-end server perms.

So I've got the following in IIS:
Exadmin
Exchange
EchWeb
Microsoft-SErver-ActiveSync
MobileAdmin
OMA

And a couple of others that I dont think are relevant.

Can I change the permissions on one of these to restrict who can connect to Activesync?

As a bonus: Can I do it in a way that does not affect ordinary browser based Exchange Access?

Thanks in Advance!!

share|improve this question

4 Answers 4

It wouldn't be recommended to alter the permissions in IIS. You can control Activesync on a user by user basis in the properties of the user account in ADUC. Select the Exchange Features tab and disable the User Intitiated Synchronization feature.

share|improve this answer

To visualize Joes answer:

alt text

share|improve this answer
    
@ITGuy24: Thanks for the assist. A picture is worth a thousand words. ;) –  joeqwerty Mar 25 '10 at 2:00

Thanks for the answers. Setting the flags on the individual users' accounts is what I did. I ended up scripting it using a modified version of the script here: http://www.flobee.net/script-to-disable-exchange-activesync-for-unauthorized-users/

share|improve this answer

If ISA is AD-integrated or can do LDAP group enumeration, then you could create an AD group and add those permitted to use ActiveSync. Then restrict use of the ActiveSync proxy rule(s) or listener to only that AD group.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.