We have Five blackberry users in our office who own their own Blackberry's.. We set all their blackberry's email account from the blackberry itself and selected Exchange email account. All the email accounts work fine. One of the employees is no longer with us, we need to disable their ability to retrieve email on their blackberry. We tried disabling their Active Directory account and the blackberry still receives email. I'm trying to figure out how the blackberry is able to authenticate when the AD account has been disabled. Anyone with any idea's please chime in. I feel that this is a large security hole. Thanks.

You really need to remove the email account from BIS/email setup. I'm assuming that you're using BIS since you don't mention a BES server.

It does seem like disabling the AD account should break email delivery. I really can't offer any suggestions there but the step above is a precaution that you should be taking in addition to disabling the user's email.

Thanks you for the input. Yes, we are using BIS. The biggest problem I have is that I no longer have access to that person's personal blackberry. And I can't just delete their email account from exchange as I need to forward their mail to another user for some time. I realize that disabling their AD account does not stop exchange from receiving mail to their account (I would need to delete their exchange mailbox), but I thought that it would have at-least kept the blackberry from being able to authenticate against the exchange account. Anyone else have any other suggestions?

Disabling their account on the carrier's BIS page should do it. You need their password though to log in and make the deletion. Are the users getting their mail through a generic public email service like GMail, or do you have a company domain name for email accounts? Something like ?

Disable OWA, POP and IMAP access for the user.

Yes we are using our own domain name email. We are running exchange 2003. As far as disabling OWA, POP and IMAP, I think one of the other IT guys tried that, but I wlil double check with him.

This seems more like an Exchange/AD issue to me, it seems like you could be having some type of replication issue I say this because we have many employees that own their blackberry and just set it up using BIS and a simple password change will break their email let alone deleting them from AD and exchange, I would go onto the exchange server and delete the user from the actual exchange user snap in cause if they are still listed there then you can be sure that your DC is not replicating with your exchange server completely. I would also track down their actual mailbox and delete it.