Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I was asked to set up an Exchange Activesync mobile gateway. That's done. It's a separat eExchange 2003 front-end server configured for SSL, and I've put an off-domain ISA server in front of it. Now I'm being asked to limit which users can connect to it.

By default an Exchange front-end server allows any user who has a mail account to connect to the front -end server. So I'm looking at the permissions on the various IIS sites/apps on the server, but I know that it's easy to break Exchange Front-end server perms.

So I've got the following in IIS:

And a couple of others that I dont think are relevant.

Can I change the permissions on one of these to restrict who can connect to Activesync?

As a bonus: Can I do it in a way that does not affect ordinary browser based Exchange Access?

Thanks in Advance!!

share|improve this question

It wouldn't be recommended to alter the permissions in IIS. You can control Activesync on a user by user basis in the properties of the user account in ADUC. Select the Exchange Features tab and disable the User Intitiated Synchronization feature.

share|improve this answer

To visualize Joes answer:

alt text

share|improve this answer
@ITGuy24: Thanks for the assist. A picture is worth a thousand words. ;) – joeqwerty Mar 25 '10 at 2:00

Thanks for the answers. Setting the flags on the individual users' accounts is what I did. I ended up scripting it using a modified version of the script here:

share|improve this answer

If ISA is AD-integrated or can do LDAP group enumeration, then you could create an AD group and add those permitted to use ActiveSync. Then restrict use of the ActiveSync proxy rule(s) or listener to only that AD group.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.