Outlook has been around for a long time, and there are many versions with different features and varying levels of security fixes.  It’s not always desirable to let any version of Outlook connect to Exchange Server as you may require your clients to utilize a specific feature set, such as Messaging Records Management, or to have certain security fixes.  You may also have corporate policy which dictates that a particular version or versions of Outlook are used.

Fortunately Exchange has the ability to restrict which versions of Outlook can connect by blocking MAPI client versions, a feature which was introduced in Exchange 2000 Service Pack 1.  In Exchange 2007 MAPI client blocking can be implemented on a per-server basis using a registry change, or on a per-mailbox basis using the Exchange Command Shell.

Additionally, Microsoft recommends implementing Outlook client blocking as a best practice, and if you run the Exchange Best Practices Analyzer against a server which does not have client blocking enabled it will suggest that you configure it.

Determining Which Client Versions are in use

Before implementing client version blocking it’s a good idea to know versions are in use.  With this information you can tell which clients need to be upgraded to a newer version before blocking is implemented, or simply which clients will no longer be able to connect after it is implemented.  In Exchange 2007 client version information is retrieved using the Get-LogonStatistics cmdlet.

Get-LogonStatistics accepts a mailbox, a mailbox database, or a server name as input and returns statistics including user name, logon time, last access time, client name, and client version.

For example, to list the client versions used to access a single mailbox, the command is:

To list the client versions for all clients connecting to a specific server:

To list the client versions for all clients on all mailbox servers, and export the results to a CSV file:

Once you have identified the clients in use in your organisation and taken any remedial action necessary you can move on to blocking any further access by unwanted clients.

Determining Which Client Versions to Block

The client version is determined by the version of Emsmdb32.dll on the client.  This is not necessarily the same as the Outlook version, or the version of any other DLL or executable files.  This table shows the version of Emsmdb32.dll for major releases or updates of Outlook since the release of Office XP.

Table 1 – Emsmdb32.dll version by Office release

There are some important points to note:

• The MAPI client version numbers listed in Table 1, and those in the results of the Get-LogonStatistics cmdlet, are in the format x.0.y.z.  When specifying MAPI versions to be blocked you must use the format x.y.z.  For example, the version number for Outlook 2003 RTM becomes 11.5604.0.

• When setting per-server restrictions it is very important to avoid restricting clients with version numbers 6.y.z  as Exchange Server makes use of MAPI for server-side component connections and uses MAPI versions within the 6.y.z range (with the version number potentially varying by Exchange component and patch level).  This does not apply to per-mailbox restrictions.

• Microsoft recommends that at a minimum you block all MAPI clients with version numbers equal to or earlier than 5.3164.0.0.

Single versions are blocked by specifying the version in the format <version>, an open-ended range is blocked by using the format -<version1> or <version2>-, and a specific inclusive range is blocked by using the format <version3>-<version4>.  Multiple sets of client versions can be disabled using a comma or semi-colon separated list.

Table 2 – Example client version blocking syntax

Some example blocking settings to use:

Table 3 – Example client version blocking settings

 

Implementing the Blocking Settings

As mentioned earlier, restrictions can be implemented per-server or per-mailbox.  Per-server restrictions are implemented via a registry change, and per-mailbox restrictions are implemented via the Exchange Management Shell – it is not possible to use the Exchange Management Console.

If both server and mailbox restrictions are used the most restrictive combination of both settings applies, additionally a server restriction cannot be overridden by a mailbox setting.

For example:

Table 4 – Cumulative effect of restrictions

To implement a per-server restriction

Note – Incorrectly editing the registry can cause serious problems that may require you to reinstall your operating system. Problems resulting from editing the registry incorrectly may not be able to be resolved.  Before editing the registry, back up any valuable data. 

You need to be a local administrator on the Exchange server in order to edit the registry.

1. Start the registry editor on your Exchange 2007 Mailbox server

2. Locate the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem registry key.

3. Right-click ParametersSystem, select New, and then select String value.

4. Name the new string value “Disable MAPI Clients”.

5. Right-click Disable MAPI Clients, and then click Modify.

6. Enter the restriction setting, for example -5.9.9;7.0.0-11.9.9

7. Close the registry editor

The change will be effective within 15 minutes, or to make it effective immediately you can restart the Microsoft Exchange Information Store service.  Once the change takes effect any existing client connections which do not meet the version requirements will be terminated.

To implement a per-mailbox restriction

The Set-CASMailbox cmdlet is used to implement per-mailbox restrictions.  To use the Set-CASMailbox cmdlet you must be delegated the Exchange Recipient Administrator role.

To prevent a mailbox from using Outlook clients prior to Outlook 2007 the command is:

To remove a restriction for a mailbox:

To prevent all mailboxes in a particular database from using clients other than Outlook 2007 RTM:

When an Outlook 2003 or Outlook 2007 user tries to connect with a restricted client version they will receive the message “Your Exchange Server administrator has blocked the version of Outlook that you are using. Contact your administrator for assistance.”

Users of older clients will receive the message “Cannot start Microsoft Outlook. The attempt to log on to the Microsoft Exchange Server computer has failed.”

More information on Get-LogonStatistics and Set-CASMailbox can be found in TechNet:

• Get-LogonStatistics – http://technet.microsoft.com/en-us/library/bb124415.aspx
• Set-CASMailbox – http://technet.microsoft.com/en-us/library/bb124415.aspx