Hi all... I have a real tricky issue at hand. The problem is, IT Auditors have pointed out that users goind on vacation/leave doesn't see their accounts disabled on applications/machines etc., which is indeed a security and logging issue here. The problem with disabling their account on Active directory is, it would also lead to them being unable to access their emails via OWA, which in many cases, they need to access. The email ID authentication for OWA talks to AD at the backend. What's the solution here? Is there a way I can disable everything else except the OWA access for this user on vacation?

Restricting logon to the OWA server and the Exchange back-end only might do the trick since they wouldn't be able to logon to anything else. Peter