Diary of an IT Guy

Heart passion to keep the brain moving>>>

Block One Drive for Business Syncronization to Non-Joined Domain PC

leave a comment »

OFBIf your company is using Office 365, of course, you as an IT Admin wants the office’s data remains secure. In order to make the data in One Drive for Bussiness and Sharepoint Online stay safe, then you must  to inactivate the syncronization feature on PCs that do not join the domain like home PC. So if the employee resign, they are difficult to copy the company work files.

The Prerequsites are:
1. You know the domain GUID active directory (AD) in the office
2. You have access to the company’s Office 365 powershell

Here are the steps:
1. To determine the domain GUID  : log in as Administrator to the domain controller and use powershell with the following command (bold text):



Windows PowerShell
Copyright (C) 2014 Microsoft Corporation. All rights reserved.


PS C:\Users\Administrator> $domains = (Get-ADForest).Domains; foreach($d in $domains) {Get-ADDomain -identity $d | Select ObjectGuid}

The result:

ObjectGuid
----------
19e5a505-2498-42b3-a426-fb3aeb5976fs

PS C:\Users\Administrator>

2. Install the latest shell management sharepoint online on your laptop (at least OS windows 7). And do the following command line (as Administrator):

Login to sharepoint online:

PS C:\WINDOWS\system32> $cred=Get-Credential

PS C:\WINDOWS\system32> connect-sposervice -url https://TenantName-admin.sharepoint.com/ -credential $cred

Set restriction that only PC that has been join domain (Domian GUIID: 19e5a505-2498-42b3-a426-fb3aeb5976fs) can sync to one drive for bussiness:

PS C:\WINDOWS\system32> Set-SPOTenantSyncClientRestriction -enable -DomainGuids "19e5a505-2498-42b3-a426-fb3aeb5976fs"

The result:

 TenantRestrictionEnabled : True
 AllowedDomainList : {19e5a505-2498-42b3-a426-fb3aeb5976fs}
 BlockMacSync : False
 ExcludedFileExtensions : {}
 OptOutOfGrooveBlock : True
 OptOutOfGrooveSoftBlock : True

 

Then optionally we can block Mac sync functionality. The command is (in bold text):

PS C:\WINDOWS\system32> Set-SPOTenantSyncClientRestriction -Enable -DomainGuids "19e5a505-2498-42b3-a426-fb3aeb5976fs" -BlockMacSync:$true

 

The result:

 TenantRestrictionEnabled : True
 AllowedDomainList : {19e5a505-2498-42b3-a426-fb3aeb5976fs}
 BlockMacSync : True
 ExcludedFileExtensions : {}
 OptOutOfGrooveBlock : True
 OptOutOfGrooveSoftBlock : True

 

Then we can disable syncronization for file extension that bandwidth consuming like PST, videos, EXE, etc. The command is (in bold) :

PS C:\WINDOWS\system32> Set-SPOTenantSyncClientRestriction -ExcludedFileExtensions "pst;ost;mp3;mp4;exe;zip;rar;7z;tif;psd;jpg;mkv;flv;3gp;msi;mpg;mov"

 

The result:

 TenantRestrictionEnabled : True
 AllowedDomainList : {19e5a505-2498-42b3-a426-fb3aeb5976fs}
 BlockMacSync : True
 ExcludedFileExtensions : {pst, ost, mp3, mp4...}
 OptOutOfGrooveBlock : True
 OptOutOfGrooveSoftBlock : True

 

Then We can block users in  from syncing OneDrive for Business libraries who using the old OneDrive for Business sync client. Users will be prompted to upgrade to the new client.

PS C:\WINDOWS\system32> Set-SPOTenantSyncClientRestriction -GrooveBlockOption "HardOptIn"

 

The result:

 TenantRestrictionEnabled : True
 AllowedDomainList : {19e5a505-2498-42b3-a426-fb3aeb5976fs}
 BlockMacSync : True
 ExcludedFileExtensions : {pst, ost, mp3, mp4...}
 OptOutOfGrooveBlock : False
 OptOutOfGrooveSoftBlock : True

 

Done. Please wait about 3 hours until 24 hours untill it takes effect to the cloud system.

Here is the screenshot notification in One Drive for Business that user is prohibited to sync EXE and JPG files :

one_drive_prohibited

References:

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s

%d bloggers like this: