The way to query it depends on the Exchange version
Exchnage 2003:
something like
(&(objectClass=user)(homeMDB=*)
(|(protocolSettings:HTTP§1§1§§§§§§)(protocolSettings=HTTP§1§0§§§§§§)
(!(protocolSettings=*)
)
)
Exchange 2007:
get-casmailbox | where-object {$_.OWAEnabled -eq $TRUE}
Henry