Environment is Exchange 2007 SP2, have two cas/hub servers and one CCR cluster. It seems that disabling an account in AD is not preventing people from logging into OWA and sending emails. As a test, I created a new account, mail enabled it, sent a few test emails, then disabled it, changed the password, and moved the mailbox to another storage group. One hour and thirty minutes later, and I can still log into OWA with the original password and send emails. Short of deleting or disabling the mailbox (have to archive the contents, but can't always do that immediately) what do I need to do to prevent access to mailboxes once someone is disabled?

Hi, Why dont u disable them from EMC or EMS. In EMS u can run Disable-Mailbox MailboxEmailAddress Regards,Laeeq Qazi|Team Lead(Exchange + Sharepoint + BES + DynamicsCRM) www.HostingController.com

As I stated in the post, that's not always an option.

Hi, There are two options if u dont want to disable the mailbox. User wont be able to login to OWA again ( I hope in outlook too but i havent tested outlook) 1. Run IISReset command on windows command prompt 2. Remove exchange specific attributes from the user using ADSIEdit. This is little risky if u want to enable this user again later, but is an option. First option is easy one. Regards, Laeeq Qazi|Team Lead(Exchange + Sharepoint + BES + DynamicsCRM) www.HostingController.com

OK, thanks for the tip. But for the record, I think this is a HUGE security issue. I disabled my test account over three hours ago, and I can still send email from it. I did an iisreset (hope no one complains) and that stopped it.