Applies to: Office 365 for enterprises, Live@edu
Topic last modified: 2013-01-09
By default, all new user accounts are allowed to use Windows Remote Management (WinRM) to access the cloud-based organisation with Windows PowerShell. However, you can prevent new and existing users from using Windows PowerShell to access your cloud-based organisation.
Here's how:
- Prevent access for a new user in Live@edu
- Prevent access for a new user in Office 365
- Prevent access for an existing user
- Prevent access for many existing users
- Grant access
- Find out who has access already
To learn how to install and configure Windows PowerShell and connect to the service, see Use Windows PowerShell.
Run the following command:
New-Mailbox -Name <Name> -WindowsLiveID <Windows Live ID> -Password (ConvertTo-SecureString -String '<Password>' -AsPlainText -Force) -RemotePowerShellEnabled $false
For example, to prevent access for a new user named "Kim Akers" with the Windows Live ID kakers@contoso.edu and the password Pa$$word1, run the following command:
Run the following command:
New-Mailbox -Name <Name> -MicrosoftOnlineServicesID <Microsoft Online Services ID> -Password (ConvertTo-SecureString -String '<Password>' -AsPlainText -Force) -RemotePowerShellEnabled $false
For example, to prevent access for a new user named "Kim Akers" with the Microsoft Online Services ID kakers@contoso.com and the password Pa$$word1, run the following command:
Run the following command:
For example, to prevent access for the user laura@fabrikam.com, run the following command:
There are two ways to prevent access for a specific group of existing users:
- Filter the users based on an existing attribute This method assumes that the target user accounts all share a unique filterable attribute. For example, the Title, Department, or one of the CustomAttribute1-15 attributes are the same for and unique to all the affected users. Note that some attributes, such as Title, Department, address information and telephone number, are visible only when you use the Get-User cmdlet. Other attributes, such as CustomAttribute1-15, are visible only when you use the Get-Mailbox cmdlet.
- Use a list of specific accounts After you generate the list of specific accounts, you can use that list to assign a mailbox plan.
Run the following command:
<Get-Mailbox | Get-User> -ResultSize unlimited -Filter <Filter> | Set-User -RemotePowerShellEnabled $false
For example, let's assume you manage a Live@edu organisation and you want to prevent access for students in the primary years and you've stored students' year level in the Title attribute. To prevent access for all mailboxes where the Title property contains "Primary", run the following command:
Run the following command:
For example, the following procedure uses the text file C:\My Documents\NoPowerShell.txt to identify the users by their user IDs. The text file must contain one user ID on each line like this:
After you populate the text file with the user accounts you want to update, run the following command:
To grant access to existing users who have been denied access in the past, simply use the value $true with the RemotePowerShellEnabled parameter as described in the previous examples.
To grant access to new users you create using Windows PowerShell, you do not need to use the RemotePowerShellEnabled parameter at all, because all new users are granted access automatically.
To find out who has access and view all users' access status, you can use Windows PowerShell.
Run the following command:
For example, to determine the access status of a user named "Tamara Johnston", run the following command:
Run the following command:
To display only those users who don't have access, run the following command:
To display only those users who have access, run the following command:
