Many organizations have webmail exposed to the world. These sites are often hooked up to AD for user authentication. Are there any specific security controls OWA (Outlook web app) has that would prevent or degrade an attacker's ability to lock out everyone once the userid pattern is known?


There are a variety of ways that this can be mitigated, but here are a couple.

  1. Two-factor authentication : something you have (a SecurID fob for instance) and something you know (a password)
  2. A PowerShell script to parse logs and add firewall rules based on a number of failed login attempts located in the Event Viewer
  3. A product such as Messageware OWA Guard which will monitor your OWA instance and identify potential risks in real-time (full disclosure : I have no experience with this product and cannot vouch for its effectiveness)
  • I suppose if you use two factor you can turn off the lockout setting? – k to the z Jun 16 '14 at 22:38

If you are using Office 365, then you can consider Azure Multi-Factor Authentication, which you can simply turn on with Office 365. It has options such as requiring phone-based response before accepting a sign-in. You can also integrate it with your on-premises applications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.