Control remote PowerShell access to Exchange servers
Remote PowerShell in Microsoft Exchange allows you to manage your Exchange organization from a remote computer that's on your internal network or from the Internet. You can disable or enable a user's ability to connect to an Exchange server using remote PowerShell. For more information about remote PowerShell, see Exchange Server PowerShell (Exchange Management Shell).
For additional management tasks related to remote PowerShell, see Connect to Exchange servers using remote PowerShell.
What do you need to know before you begin?
Estimated time to complete each procedure: less than 5 minutes
You can only use PowerShell to perform this procedure. To learn how to open the Exchange Management Shell in your on-premises Exchange organization, see Open the Exchange Management Shell.
By default, all user accounts have access to remote PowerShell. However, to actually use remote PowerShell to connect to an Exchange server, the user needs to be a member of a management role group, or be directly assigned a management role that enables the user to run Exchange cmdlets. For more information about role groups and management roles, see Exchange Server permissions.
For detailed information about OPath filter syntax in Exchange, see Additional OPATH syntax information.
You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Remote PowerShell" entry in the Exchange infrastructure and PowerShell permissions topic.
Tip
Having problems? Ask for help in the Exchange forums. Visit the forums at Exchange Server.
Use the Exchange Management Shell to enable or disable remote PowerShell access for a user
This example disables remote PowerShell access for the user named Therese Lindqvist.
Set-User "Therese Lindqvist" -RemotePowerShellEnabled $false
This example enables remote PowerShell access for the user named Sirirat Kitjakarn.
Set-User "Sirirat Kitjakarn" -RemotePowerShellEnabled $true
Use the Exchange Management Shell to disable remote PowerShell access for many users
To prevent remote PowerShell access for a specific group of existing users, you have the following options:
Filter users based on an existing attribute: This method assumes that the target user accounts all share a unique filterable attribute. Some attributes, such as Title, Department, address information, and telephone number, are visible only when you use the Get-User cmdlet. Other attributes, such as CustomAttribute1-15, are visible only when you use the Get-Mailbox cmdlet.
Use a list of specific users: After you generate the list of specific users, you can use that list to disable their access to remote PowerShell.
Filter users based on an existing attribute
To disable access to remote PowerShell for any number of users based on an existing attribute, use the following syntax:
$<VariableName> = <Get-Mailbox | Get-User> -ResultSize unlimited -Filter <Filter>
$<VariableName> | foreach {Set-User -RemotePowerShellEnabled $false}
This example removes access to remote PowerShell for all users whose Title attribute contains the value "Sales Associate".
$DSA = Get-User -ResultSize unlimited -Filter "(RecipientType -eq 'UserMailbox') -and (Title -like '*Sales Associate*')"
$DSA | foreach {Set-User -RemotePowerShellEnabled $false}
Use a list of specific users
To disable access to remote PowerShell for a list of specific users, use the following syntax:
$<VariableName> = Get-Content <text file>
$<VariableName> | foreach {Set-User -RemotePowerShellEnabled $false
This example uses the text file C:\My Documents\NoPowerShell.txt to identify the users by their user principal name (UPN). The text file must contain one UPN on each line like this:
akol@contoso.com
tjohnston@contoso.com
kakers@contoso.com
After you populate the text file with the user accounts you want to update, run the following commands:
$NPS = Get-Content "C:\My Documents\NoPowerShell.txt"
$NPS | foreach {Set-User -RemotePowerShellEnabled $false}
View the remote PowerShell access for users
To view the remote PowerShell access status for a specific user, use the following syntax:
Get-User -Identity <UserIdentity> | Format-List RemotePowerShellEnabled
This example displays the remote PowerShell access status of the user named Sarah Jones.
Get-User -Identity "Sarah Jones" | Format-List RemotePowerShellEnabled
To display the remote PowerShell access status for all users, run the following command:
Get-User -ResultSize unlimited | Format-Table -Auto Name,DisplayName,RemotePowerShellEnabled
To display only those users who don't have access to remote PowerShell, run the following command:
Get-User -ResultSize unlimited -Filter 'RemotePowerShellEnabled -eq $false'
To display only those users who have access to remote PowerShell, run the following command:
Get-User -ResultSize unlimited -Filter 'RemotePowerShellEnabled -eq $true'
Feedback
Loading feedback...