Questions tagged [exchange]

Microsoft Exchange Server is a widely used email server that is used with all versions of Microsoft's Outlook, Entourage, IMAP, and POP3 clients. It is also used to host Microsoft's Office 365 cloud offering.

Filter by
Sorted by
Tagged with
1
vote
1answer
73 views

Does a Mailbox Export Request modify the mailbox data?

The procedure suggested by forensics companies to make a copy of a users's mailbox in a forensically sound manner is to use New-MailboxExportRequest. What information is modified (if any) by the use ...
1
vote
1answer
663 views

How effective is Activesync Certificate revocation using CRL or OCSP

We determined that a number of our account lockout issues are related to Activesync devices using old/expired passwords. One way to remedy an account lockout issue is to issue and deploy certificates ...
1
vote
0answers
60 views

Exploit CVE-2020-0688 for older versions

I wanted to exploit my IIS CVE-2020-0688, which I saw that the key is the same as advertised. The problem is that my IIS is old, and uses AppPool of .NET 2 and not .NET 4. Also I can use only GET as ...
1
vote
1answer
41 views

Email security between Outlook and Exchange 365 [duplicate]

From what I've understood by reading message headers and settings in Outlook, mails sent between Outlook on my PC and the Exchange cloud service are encrypted with TLS 1.2. Messages moving within the ...
1
vote
0answers
878 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
0answers
479 views

How should an ISP approach Mutual Auth TLS for SMTP email? (Domain Auth Email)

I'm looking for an easy to deploy way to make email clients (MUAs) display my email messages in a secure manner. PGP and SMIME both do this today, but they are high touch, and require software or ...
1
vote
0answers
165 views

Does Activesync certificate authentication replace a password, or act as 2 factor?

I am looking at Activesync authentication and want to know if Certificate Authentication ignores a client username and password or Certificate Authentication requires a username and password For ...
1
vote
0answers
382 views

Securing MS Exchange [closed]

I have read quite a bit on the subject of securing MS Exchange - most notably the Client Access role. With the retirement of Microsoft's Threat Management Gateway many people seem to be looking for an ...
1
vote
1answer
135 views

Automatically import/deploy/distribute private key to users for use with S/MIME

it is an Environment with Microsoft Active Directory, Exchange and Windows/Outlook as Client. Now there are the users which have their own private certificates to send signed mails and encrypt ...
0
votes
2answers
2k views

List of unpatchable exploits in MS Exchange 2003 [duplicate]

Possible Duplicate: Where can I find a list of un-patched CVEs for a specific piece of software? MS Exchange 2003 is no longer supported by Microsoft since April 2009. However the Exchange ...
0
votes
1answer
371 views

Exchange Security - outgoing email marked as spam by recipients [closed]

Our company emails are getting blocked (blacklisted) every other day. Can someone tell us why the emails are getting blocked. And how to rectify for being blocked. Your advise will be highly ...
0
votes
2answers
488 views

When Activesync policy is applied to iPhones allows thumbprint-unlock, while Android does not. Which is correct?

We have a long-standing ActiveSync device policy that requires an unlock code for all phones that use corporate email. It seems that iPhones with "swipe to unlock" and Android phones with similar ...
0
votes
1answer
367 views

block changing IP addresses on port 25 SMTP

A script is currently being run against my exchange server attempting to access resources on port 25 SMTP. This is generating event 4776 within Windows event logs. How can I stop this? Would I need to ...
0
votes
1answer
707 views

How should I configure DMARC (or DKIM?) to deal with OWA forwarding changing email bodies?

For my own domain (mydomain.com, hosted with a free G Suite), I have setup DMARC in testing mode: v=DMARC1; p=none; sp=reject; aspf=s; adkim=s; rua=mailto:dmarc@mydomain.com I have sent out test ...
0
votes
1answer
41 views

Reason to Require A VPN Client for Exchange 2010 and Newer?

Reading Microsoft's Publishing Exchange Server 2010 with Forefront Unified Access Gateway 2010 and Forefront Threat Management Gateway 2010, it looks like encryption is baked in for client access in ...
0
votes
3answers
1k views

DNS in DMZ or not and mail server architecture

I wonder what server I put in DMZ zone. I know the DMZ zone is for all servers or services who must be accessed from the internet, like Web Server, or mail server and sometimes DNS servers. But I ...
0
votes
1answer
1k views

Exchange Autodiscover XML question (Exploit related)

Recently we had an issue with the Exchange autodiscover.xml appending ".com" to our mail servers autodiscover address. It resulted in a certificate error due to the name not matching the certificate. ...
0
votes
0answers
91 views

Watch Encrypted IMAP Responses

I'm trying to see if I can decipher the messages coming back from Exchange when I try and login via secure IMAP. My office 365 accounts are under attack and I've disabled IMAP (and legacy login) but ...
0
votes
1answer
2k views

A replay attack was detected (4649) & Exchange Healthmailbox

We received alarms for this in our SIEM today. I believe it is expected and just "noise". The alarm was triggered immediately after Exchange cleared the ThrottlingConfig.log. I know Exchange ...
0
votes
1answer
304 views

Blocking Email Attachment download from outside company in Office 365

In Office 365, Emails can accessed from anywhere (within or outside of the company). Want to block Email attachment download from outside of the company. Emails should be accessible from outside of ...
0
votes
0answers
85 views

What does it mean when a message's contentes are replaced by “Malware name: 'EngineError'” [duplicate]

Possible Duplicate: Does a blocked email with a malware name “EngineError” indicate a flaw in Forefront Protection? A privious post on this topic was closed as "unlikely to ever help ...
-1
votes
1answer
44 views

Do any API-based CASB use native DLP features in cloud applications?

I think I've understood what CASB are and the differences between proxy/API-based architectures. What is still unclear to me is how exactly API-based CASB function. I know most products use APIs to ...

1
2