Exchange 2007 allows for easier implementation of Outlook Web Access per-user segmentation. To configure per-user segmentation in earlier versions of Exchange, you must set the msExchMailboxFolderSet attribute on the particular user's Active Directory object by using a tool such as the ADSI Edit tool. In Exchange 2007, you can use the Set-CASMailbox cmdlet to configure per-user segmentation.
.gif) Note: |
|---|
|
You can use the Set-CASMailbox cmdlet to configure per-user settings for Exchange ActiveSync, Outlook Web Access, MAPI, POP, and IMAP.
|
The following two cmdlets are available to retrieve or configure user settings:
-
Get-CASMailbox
This cmdlet retrieves the settings for a particular user.
-
Set-CASMailbox
This cmdlet configures settings for a particular user.
Both cmdlets take the identity parameter. The identity parameter specifies the particular user's domain name and user name, such as contoso\user1. Also, because many components share the Get-CASMailbox and Set-CASMailbox cmdlets, Exchange uses a naming convention to specify the properties that are being retrieved or configured.
Each property has a prefix to specify the component name to which it belongs. For example, Outlook Web Access properties have an OWA prefix. MAPI properties have a MAPI prefix. To view the Outlook Web Access segmentation settings for a user, run the following command at the Exchange Management Shell:
Get-CASMailbox -identity "contoso\<user1>" | fl OWA*
When you run this command, you see results that resemble the following:
|
OWAEnabled : True
OWACalendarEnabled :
OWAContactsEnabled :
OWATasksEnabled :
OWAJournalEnabled :
OWANotesEnabled :
OWARemindersAndNotificationsEnabled :
OWAPremiumClientEnabled :
OWASpellCheckerEnabled :
OWASearchFoldersEnabled :
OWASignaturesEnabled :
OWAThemeSelectionEnabled :
OWAJunkEmailEnabled :
OWAUMIntegrationEnabled :
OWAWSSAccessOnPublicComputersEnabled :
OWAWSSAccessOnPrivateComputersEnabled :
OWAUNCAccessOnPublicComputersEnabled :
OWAUNCAccessOnPrivateComputersEnabled :
OWAActiveSyncIntegrationEnabled :
OWAAllAddressListsEnabled :
OWAChangePasswordEnabled :
|
Each property in virtual directory segmentation has a corresponding per-user segmentation property. By default, per-user segmentation properties are not set. This is why most of the properties in the previous results do not contain any values.
When you configure per-user segmentation, the commands that you use set bits in an integer that is named msExchMailboxFolderSet. The first time that you modify a per-user segmentation setting, all the bits in the msExchMailboxFolderSet integer must be set to a particular value. By default, Exchange sets every value to False unless you explicitly set the value(s) to True.
Therefore, you may experience unexpected behavior when you try to configure a particular value. For example, assume that you run the following cmdlet to disable the Change Password feature in Outlook Web Access:
Set-CASMailbox -identity "contoso\<user1>" -OWAChangePasswordEnabled:$false
After you run this command, you see the following results when you view the properties for the particular user:
|
OWAEnabled : True
OWACalendarEnabled : False
OWAContactsEnabled : False
OWATasksEnabled : False
OWAJournalEnabled : False
OWANotesEnabled : False
OWARemindersAndNotificationsEnabled : False
OWAPremiumClientEnabled : False
OWASpellCheckerEnabled : False
OWASearchFoldersEnabled : False
OWASignaturesEnabled : False
OWAThemeSelectionEnabled : False
OWAJunkEmailEnabled : False
OWAUMIntegrationEnabled : False
OWAWSSAccessOnPublicComputersEnabled : False
OWAWSSAccessOnPrivateComputersEnabled : False
OWAUNCAccessOnPublicComputersEnabled : False
OWAUNCAccessOnPrivateComputersEnabled : False
OWAActiveSyncIntegrationEnabled : False
OWAAllAddressListsEnabled : False
OWAChangePasswordEnabled : False
|
In this example, although you had intended to disable only the Change Password feature, Exchange sets all the unset features to False. Therefore, for an msExchMailboxFolderSet attribute that has not been set, you must explicitly configure every feature.
In the previous example, to disable only the Change Password feature on an unset msExchMailboxFolderSet attribute and to leave all the other features enabled, you have to explicitly configure each feature. To do this, you must run the following command:
set-CASMailbox -identity "contoso\<user1>" -OWAChangePasswordEnabled:$false `
-OWAPremiumClientEnabled:$true `
-OWACalendarEnabled:$true `
-OWAContactsEnabled:$true `
-OWATasksEnabled:$true `
-OWAJournalEnabled:$true `
-OWANotesEnabled:$true `
-OWARemindersAndNotificationsEnabled:$true `
-OWASpellCheckerEnabled:$true `
-OWASearchFoldersEnabled:$true `
-OWASignaturesEnabled:$true `
-OWAThemeSelectionEnabled:$true `
-OWAJunkEmailEnabled:$true `
-OWAUMIntegrationEnabled:$true `
-OWAWSSAccessOnPublicComputersEnabled:$true `
-OWAWSSAccessOnPrivateComputersEnabled:$true `
-OWAUNCAccessOnPublicComputersEnabled:$true `
-OWAUNCAccessOnPrivateComputersEnabled:$true `
-OWAActiveSyncIntegrationEnabled:$true `
-OWAAllAddressListsEnabled:$true
After you set all the bits on the msExchangeMailboxFolderSet attribute, you can configure each individual bit without having to specify values for the other bits.
Important considerations
Consider the following when you use per-user segmentation with Outlook Web Access:
-
Per-user segmentation overrides virtual directory segmentation. For example, when you use the Set-CASMailbox cmdlet to set OWAChangePasswordEnabled to True for a user, the user will always have access to the Change Password feature, regardless of what option is set on the virtual directory.
-
You cannot use the Set-CASMailbox cmdlet to clear per-user segmentation settings. Instead, you must use ADSI Edit or a similar tool to change the msExchMailboxFolderSet attribute on the user's Active Directory object.
The OWAEnabled property is not part of Outlook Web Access segmentation. Instead, OWAEnabled is a setting in the ProtocolSettings attribute on the user's Active Directory object. The OWAEnabled property is used to allow or to block access to Outlook Web Access as a whole.