Prevent users from using PST

This article, I think, it’s pretty interesting as I’ll show you how to set up a new GPO to prevent users from using PST files in Microsoft Outlook without the need to install any Office ADM Templates.

All the GPO will do is create/modify a few registry keys (one for each version of Microsoft Office). There are two ways, depending on your environment you can choose either one or the other. The first one it’s the cleanest way to do it but it’s only supported from Windows 7 and above (and from Windows Server 2008). The second one it’s a bit more “rusty” as it basically launches a batch file and that’ll do the work. Both worked for me but at the end I chose to use option number 1 as the few XP/Vista machines we have, are about to go.

Note that I want to prevent users from growing their current PST files, this GPO will still allow them to access their existing PST files. I think this is very important. Also, they’ll be allowed to create new PST files and to attach existing ones at a later stage but they won’t be able to modify them (only create subfolders which is kind of useless).

Before showing you the configuration of both the GPOs, I will show you the core of how to prevent users from using PST files in Outlook by creating a new registry key for each Office version. For instance, if you want to deny Outlook 2016 users to add new items to their PST files, all you need to do is create this new registry Key:

And then create a REG_DWORD (value set to 1) named PstDisableGrow. You can do the same with any Office version, I went down to 11.0.

Important: This only works on the HKEY_CURRENT_USER Registry! So you must run it with the end-user account.

You can add these keys with a batch file with just a line for each version [Notice how I used echo Y | – This will skip the confirmation as it’s going to “press” it for you].

Or remove them once you want to allow the users to fully utilised PST files.

For both the GPOs, I am creating a group in Active Directory that will contain all users I want to allow PSTs for. Also, both the GPOs have been set to run only on workstations, avoiding Servers:

GPO - WMI Filtering Workstation - WMI Filter

Option #1 – Using only the standard GPO Editor (From Windows Server 2008+) for Windows 7+ clients.

  • Create a new GPO and Edit it – I called it Disable PST Grow.
  • Navigate to User Configuration\Prefernces\Windows Settings\Registry.
    • Disable PST Grow GPO Registry
  • Right click on Registry and select New > Registry Item.
  • Under Action, select Update. Fill in the rest as per the below screenshot.
    • Disable PST Grow GPO Registry - Update - General

If you also want to have an exception group, keep on reading the extra few steps. (more…)

Read More

Disable Search Index for a specific Database

Disable Search Index for a specific Database is pretty simple so this is going to be a short post. This works on Microsoft Exchange 2010 SP3.
Run the following (if you want to Enable it instead, just change $false with $true):

If you just want to check whether the Search Index is enabled or disabled for a certain database, just run:

Last command for this post covers the case when you want to list all of the databases in the environment and check if the Search Index is either enabled or disabled:

Note: Name will display the database name.

Important: If you try to activate the DB on another server, you will get an error! In order to successfully move it over to another server, use this command:

That’s it! People might ask why would you do that: that’s mainly because perhaps you have an inactive Database and in order not to use too much disk space you want to disable search index for a specific database. Next question would be: why do you have an inactive DB taking up your space? One of the many reasons that I can think of is when administrators want to keep mailboxes of people who have left the company concentrated on the same DB for a certain amount of time. That will also reduce the costs in case of a physical environment as the disk(s) reserved for this database don’t need to be superfast.

Read More