Как отключить owa на exchange 2016
Exchange Server 2013 или Exchange Server 2016 г. перенаправляет Exchange 2010 г. для OWA, Outlook в Интернете и ECP
- Exchange Server 2013 или Exchange Server 2016 года устанавливается в существующую организацию Exchange Server 2010 г.
- Недавно вы получили доступ к Outlook Web App или Exchange панель управления, когда ваш почтовый ящик был Exchange Server 2010 году.
- Почтовый ящик перемещается с Exchange Server 2010 г. на Exchange Server 2013 или Exchange Server 2016 г.
Решение 1. Убедитесь, что репликация Active Directory завершена, проверив атрибут homeMDB объекта пользователя. Это значение должно содержать значение DN базы данных почтовых ящиков Exchange Server 2013 или Exchange Server 2016 г.
Решение 2. Exchange Server 2013 или Exchange Server 2016 г. подождите 30 минут, чтобы кэш очистить или перезапустить MSExchangeOWAAppPool. Обратитесь к следующему скриншоту в Exchange Server 2013 г.
- Перейдите в Internet Explorer, откройте параметры Интернета.
- На вкладке Общие нажмите кнопку Удалить.
- Выберите параметр Cookies и данные веб-сайта и нажмите кнопку Удалить.
Решение 3. Повторное наследование разрешений для объекта пользователя, у которого есть проблемы при доступе к OWA или ECP
- Начните редактирование ADSI, нажав кнопку Начните, нажмите кнопку Запустить, введите adsiedit.msc и нажмите кнопку ОК.
- Найдите объект пользователя, щелкните правой кнопкой мыши объект, а затем нажмите свойства.
- На вкладке Безопасность нажмите кнопку Advanced.
- Нажмите кнопку Разрешить наследуемые разрешения от родителя распространяться на этот объект и все объекты для детей, чтобы повторно включить разрешения наследования.
- Нажмите кнопку ОК два раза, чтобы применить изменение.
- Подождите репликации Active Directory для распространения изменений или принудительного копирования Active Directory, если это необходимо.
Disable the External OWA on Exchange 2016
During the recent events, our security guy ask from me to disable the External OWA from our Exchange Servers.
We are using Exchange 2016 in DAG environments that include 2 Servers.
The Exchange Servers using the CU18.
We publish the External address with different name using different method.
The Original OWA address is like: mail.domain.com/owa
and the external address is like: web.domain.com/owa by SSL Juniper
The mobile Device using: ActiveSync
In the ECP I able to restrict the access logging Using IIS «IP Address and Domain Restriction» feature.
But OWA this is another thing.
I’m afraid that if I will restrict the OWA with the IIS feature, all the mobile devices will stop sync the mails.
So my question is, if there is right way to accomplish that without destroying the sync for mobile devices from the Exchange side?
Align RPOs and RTOs to meet your SLAs
JitenSh 
Why do you need to block? Are you seeing any brute force attacks? with IP and domain restrictions you can block OWA as well.
Why not implement 2 factor for OWA
9 Replies
JitenSh
Why do you need to block? Are you seeing any brute force attacks? with IP and domain restrictions you can block OWA as well.
Why not implement 2 factor for OWA
JitenSh
you will need 3rd party tools
Craig4129
I would not disable the OWA in the Exchange environment; this can cause all kinds of connection problems (not just activesync but also from Outlook clients that may not be on the domain, etc.). I would do as JitenSh has recommended; if Security is worried look at using 2FA. There are many different services that you can use (from Azure to Duo, etc.).
Thank you so much guys !
You can mitigate against brute force attacks with a lock out policy — say after 10 bad passwords lock the account out for 5 min. That shouldn’t inconvenience a legitimate user who occasionally mistypes a password.
I would be more concerned about a public facing exchange server that has the exchange management console installed. If someone gets admin credentials then he (or she) can change any password, get access to everyone’s email, and potentially use this to leverage further intrusions.
I also found that 2FA for OWA doesn’t play nicely with Exchange Active Sync. — yes, I know you can enable 2FA on owa «application» only in IIS but EAS still kept failing. (This MAY have been the IIS 2FA plugin on the server.) It may be overkill but any public facing exchange servers I manage only have the client access role, and I have disable the exchange management console, IMAP, POP etc so that only the absolute min services are available.
- check 196 Best Answers
- thumb_up 315 Helpful Votes
Thanks for your sharing:)
Carl Holzhauer
You can disable OWA for each user, but that also disables internal access.
Brianinca
I disable OWA by default. Maybe four years ago I cobbled up a PowerShell script to disable OWA for all users, the default it for new users not to have it enabled, and only a very few users have it turned back on.
I’ve been very tight on the BYOD policy for longer than that; we issue hundreds of phones (mostly iPhones) and iPads along with (now) a hundred or so notebooks. Almost no one needs to use a non-company owned devices for accessing email/contacts/calendar, so OWA isn’t a thing.
Essentially all the dangerous phishing attacks come from Office 365 people victimized by being accustomed to logging in to web portals. There are plenty of crummy attacks that are easily recognized, but the ones coming from known partner companies complete with accurate signatures and pertinent communication are the seriously scary attacks.
Interfering in any way with EAS would be a huge problem, it never occurred to me to disable it at the server. There were those hacks needed to make EAS it work with RPC over HTTPS back in the Exchange 2003 days, so I am loathe to do anything outside of the book. The off switch at the account level is there for a reason, I figure, and it suited my situation.
Carl Holzhauer wrote:
You can disable OWA for each user, but that also disables internal access.
This topic has been locked by an administrator and is no longer open for commenting.
Restrict disable exchange OWA Outlook Web Access ECP external-internet access and save keep EAS ActiveSync access
2)Блокировка по ip IP restrictions https://technet.microsoft.com/en-us/library/cc730889.aspx http://www.iis.net/configreference/system.webserver/security/ipsecurity
I was using IIS to prevent outside addresses from accessing my exchange 2010/2013/2016
https://docs.microsoft.com/en-us/iis/configuration/system.webServer/security/ipSecurity/
follow the link above to add the ‘ip address and domain restriction‘ [Ограничение IP-адресов и имен доменов] role to the server
powershell
then go into IIS and modify just the ECP and OWA domain restriction (i added ip restriction to the root and it will propagate to all of the ECP, EWS, MAPI, OAB, etc and it then prevented users from accessing the server)
i added an allow ip rule 192.168.0.1
mask: 255.255.255.0
to allow the LAN to access the OWA and ECP
and i added the deny everyone else below it
0.0.0.0
mask: 255.255.255.255
seems to be working
3)Редирект owa на локальный адрес Redirecting owa to external/local adress
Как отключить owa на exchange 2016
Do you have any idea why Enable/Disable OWA in EAC Exchange 2016 has no effect? As workaround we need to access exchange 2010 ECP first then Enable/Disable OWA there. Hope you can help me if i missed some configuration.
Design: Exchange 2010 and Exchange 2016 Coexist.
Thanks and regards,
What version of Exchange 2016?
have you tried another browser? does powershell not work?
Hope this helps. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
I would advise you to upgrade to at least CU14 or 15 as there are quite a number of security fixes and you are a bit behind.
What version of Exchange 2010 are you running? RU29? It also has a whole stack of fixes from all the other RU’s.
Hope this helps. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Actually we have 2 Exchange 2016 server in HA, we’ve tried installing CU15 in our Server 2 then we tested the functionality we noticed that after the update OWA and ActiveSync is not working Externally.
For the Exchange 2010 version as i remember SP3 RU9, I’ll check it tomorrow and provide you the version. we did not update this because we are preparing to decommission these servers unfortunately we cannot decom these without solving the issue in Enabling and Disabling OWA activesync in EAC 2016.
You can verify if the OWA is enabled/disabled successfully through the command after setting with the EAC:
If the version of your Exchange 2010 is SP3 RU9 as you referred above, it cannot support the coexistence with Exchange 2016, and it may be the cause of your issue. According to the official article, the minimum version requirement of the Exchange 2010 for coexistence with 2016 is Update Rollup 11 for SP3:
If you have confirmed that the version of 2010 does not meet the requirements, you need to upgrade it first. And I agree with Edward, the latest 2016 CU is the best choice.
Additionally, the OWA also could be enabled/disabled through the following command:
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.
- Предложено в качестве ответа Vera Shen Microsoft contingent staff 24 февраля 2020 г. 1:08
As per checking the build number is 14.3.123.4 (Exchange Server 2010 SP3). may i ask for your advice what’s the best move to make?
1. Decommission the Exchange 2010 Servers then Update our Exchange 2016 to the latest CU then check OWA/ActiveSync Functionality.
2. Update Exchange 2010 server to the latest RU then check OWA/ActiveSync Functionality then Decommission the Exchange Server 2010.
Based on your description, we suggest to upgrade your Exchange servers then check the OWA and ActiveSync issues. After making sure everything works well on Exchange 2016, we can move all mailboxes to Exchange 2016 and decommission Exchange 2010.
In this thread, we can concentrate on your OWA issue. For your ActiveSync issue, you can ask a new question to handle it separately.
Additionally, please provide more details about your OWA issue.
When you disable/enable OWA from EAC, did you get any alert? You can check if the setting is configured successfully by the following command:
Do user mailboxes create on Exchange 2010 or 2016 all have this issue? You can create a new user mailbox on Exchange 2016, and disable/enable the OWA from EAC to test.
Disable OWA on Ex2016 but leave EAS
For security reasons our company has decided to disable OWA (at least to the outside world), but would like to keep EAS (Activesync) available for syncing mobile devices.
Is this possible? Both use HTTP so I don’t see how to allow one but not the other (we have a simple firewall).
It would be ok to disable OWA for internal use as well. Is it possible through IIS or ECP to disable OWA only?
1 Answer 1
To my knowledge:
1. You could remove the external URL of the OWA VD in the EAC to block external access: 
If you want to disable the OWA access for certain user, you could run the command «Set-CASMailbox adam@contoso.com -OWAEnabled $false -PopEnabled $false«(From Enable or disable Outlook on the web for a mailbox)
2. Or you could also perform another method(IP Addresses and Domain Restrictions Settings in the IIS) to limit external IP. Before that, you need add the server role “IP and Domain Restrictions” in the Server Manager:
After that, you could allow your internal server IP address or a specific IP address to access the OWA in the IIS by clicking Add Allow Entry, and then deny unspecified clients to access by clicking Edit Feature Settings:
Exchange 2016/2013 — отключить изменение пароля OWA |
В этом кратком руководстве я покажу вам два способа, как вы можете остановить пользователей, меняющих там пароли Active Directory из Exchange 2013 и Exchange 2016. Это может быть полезно, если вы хотите централизовать администрирование и запретить пользователям менять пароли вне офиса.
Отключить изменение пароля OWA через ECP
Чтобы внести изменения в ECP, вам нужно перейти в следующее местоположение и отредактировать конфигурацию:
- Серверы> Виртуальные каталоги> OWA
- Особенности> Изменить пароль
Затем выберите функции и измените пароль, как показано ниже.
Это изменение необходимо будет сделать во всех виртуальных каталогах OWA, поэтому, если у вас 4 сервера, это означает 4 изменения. Затем, чтобы применить эти изменения, нам нужно перезапустить IIS, сделав следующее:
- Командная строка
Изменения станут живыми.
Отключить изменение пароля OWA через Powershell
Намного быстрее и проще, как всегда, просто введите команду ниже, заменив имя сервера на сервер, на котором размещен виртуальный каталог.
Remove Old OWA Versions to free up Disk Space
If you are running an Exchange Server for a couple of years you will soon or later notice that the free disk space on the Exchange install disk shrinks after every CU install. At this point, you can take in consideration to remove old OWA versions to free up disk space.
The size of these folders located under the path below can take be up to 2GB for each version:
/ExchangeInstallPath/V15/ClientAccess/OWA/prem
The question is:
Is it safe to remove old owa versions?
Unfortunately, I never found a satisfying answer to this question from Microsoft. On technet forums you can find answers like You can do it but it is not recommended.
This it is not a statement that makes you remove old OWA versions with peace of mind.
So I gave it a try in our test environment.
As you can see in the picture below there are some OWA version folders in the /Owa directory. The last modified date matches the date we have installed CU12 on this server. These folders belong to the current OWA version at that time. ( before we installed CU14).
In the /Owa/prem folder on the right side, you see the real OWA version folders with about 1GB in size which is eating up your disk space. After every CU install a new OWA version folder is added and the older versions are kept.
The directories compared:
When you need to upgrade a couple of servers one after another a server that already has been updated to the newest CU still needs the OWA version files from the last CU. If the mailbox which is being accessed through OWA resides on a server still running the old CU then an already upgraded server which serves OWA needs to be able to speak the old language as well.
According to this, I have moved all old OWA versions from /Owa/prem that did not have a match in /Owa and were older than 2 years to another drive. It gained me about 6GB free space.
After no problems occurred in our test environment I have used the same procedure in our production environment ( 18 servers ). There were no problems reported as well while having different CUs in place and no problems after all servers have been upgraded.