Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have created a small powershell script to disable active sync for mailboxes when the user is not a member of a specific AD group. This script works perfectly when running it from my Windows 7 workstation from the Exchange Management Shell. It does not however work on the CAS server's EMS.

$groupname = "ActiveSync Users"
$groupidentity = $(Get-Group $groupname).Identity.DistinguishedName
Get-Mailbox -ResultSize unlimited |Set-CASMailbox -ActiveSyncEnabled $false -ErrorAction SilentlyContinue -WarningAction SilentlyContinue
$users = Get-ADGroupMember $groupname | select -ExpandProperty name
foreach ($user in $users) {
    Get-Mailbox $user | Set-CASMailbox -ActiveSyncEnabled $true

Both the Get-Mailbox | Set-CASMailbox and the Get-ADGroupMember parts of the code fail on the Exchange CAS server. The Get-Mailbox | Set-CASMailbox lists warnings that no settings have been modified for every user account. The Get-ADGroupMember is erroring as a non recognized cmdlet.

It looks like either a permissions error or some dependancy is missing from the Exchange server, but I'm unsure of where to look to see what is missing.

share|improve this question
up vote 2 down vote accepted

The problem you're having is Get-ADGroupMember. You need to load the Active Directory snap-in with the command import-module ActiveDirectory. You'll need to have the "Active Directory module for Windows PowerShell" feature installed on your Exchange server for this to work.

The Get/Set commands give you that warning because your script does this:

  1. Disable all ActiveSync users.
  2. Populate $users (this is failing)
  3. Enable ActiveSync for users in $users

Since you've run the script once already, step 1 has already been completed. Running it again gives you the "no changes" warning. Fix step 2 and your script will work. Note you'll still get that warning for mailboxes that already have ActiveSync turned off, but at least you won't get it for EVERY mailbox like you are now.

share|improve this answer
Thanks for your help, importing that module did the trick. I do still get the warnings on the server but not the client, but the script does appear to be working as intended now. – Bad Dos Nov 28 '12 at 19:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.