Questions tagged [exchange]

Microsoft Exchange Server is a widely used email server that is used with all versions of Microsoft's Outlook, Entourage, IMAP, and POP3 clients. It is also used to host Microsoft's Office 365 cloud offering.

Filter by
Sorted by
Tagged with
1
vote
0answers
817 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
0answers
389 views

How should an ISP approach Mutual Auth TLS for SMTP email? (Domain Auth Email)

I'm looking for an easy to deploy way to make email clients (MUAs) display my email messages in a secure manner. PGP and SMIME both do this today, but they are high touch, and require software or ...
1
vote
0answers
162 views

Does Activesync certificate authentication replace a password, or act as 2 factor?

I am looking at Activesync authentication and want to know if Certificate Authentication ignores a client username and password or Certificate Authentication requires a username and password For ...
1
vote
0answers
375 views

Securing MS Exchange [closed]

I have read quite a bit on the subject of securing MS Exchange - most notably the Client Access role. With the retirement of Microsoft's Threat Management Gateway many people seem to be looking for an ...
0
votes
2answers
2k views

List of unpatchable exploits in MS Exchange 2003 [duplicate]

Possible Duplicate: Where can I find a list of un-patched CVEs for a specific piece of software? MS Exchange 2003 is no longer supported by Microsoft since April 2009. However the Exchange ...
0
votes
1answer
345 views

Exchange Security - outgoing email marked as spam by recipients [closed]

Our company emails are getting blocked (blacklisted) every other day. Can someone tell us why the emails are getting blocked. And how to rectify for being blocked. Your advise will be highly ...
0
votes
2answers
470 views

When Activesync policy is applied to iPhones allows thumbprint-unlock, while Android does not. Which is correct?

We have a long-standing ActiveSync device policy that requires an unlock code for all phones that use corporate email. It seems that iPhones with "swipe to unlock" and Android phones with similar ...
0
votes
1answer
365 views

block changing IP addresses on port 25 SMTP

A script is currently being run against my exchange server attempting to access resources on port 25 SMTP. This is generating event 4776 within Windows event logs. How can I stop this? Would I need to ...
0
votes
1answer
575 views

How should I configure DMARC (or DKIM?) to deal with OWA forwarding changing email bodies?

For my own domain (mydomain.com, hosted with a free G Suite), I have setup DMARC in testing mode: v=DMARC1; p=none; sp=reject; aspf=s; adkim=s; rua=mailto:dmarc@mydomain.com I have sent out test ...
0
votes
1answer
41 views

Reason to Require A VPN Client for Exchange 2010 and Newer?

Reading Microsoft's Publishing Exchange Server 2010 with Forefront Unified Access Gateway 2010 and Forefront Threat Management Gateway 2010, it looks like encryption is baked in for client access in ...
0
votes
3answers
652 views

DNS in DMZ or not and mail server architecture

I wonder what server I put in DMZ zone. I know the DMZ zone is for all servers or services who must be accessed from the internet, like Web Server, or mail server and sometimes DNS servers. But I ...
0
votes
0answers
38 views

Watch Encrypted IMAP Responses

I'm trying to see if I can decipher the messages coming back from Exchange when I try and login via secure IMAP. My office 365 accounts are under attack and I've disabled IMAP (and legacy login) but ...
0
votes
1answer
227 views

Does NTLM authentication via HTTP not need a user name?

Because of a vulnerability that has been found in Exchange Server I was trying to run that attack on our local system to see if the workaround can successfully prevent it. I found a description of ...
0
votes
1answer
59 views

Automatically import/deploy/distribute private key to users for use with S/MIME

it is an Environment with Microsoft Active Directory, Exchange and Windows/Outlook as Client. Now there are the users which have their own private certificates to send signed mails and encrypt ...
0
votes
1answer
857 views

A replay attack was detected (4649) & Exchange Healthmailbox

We received alarms for this in our SIEM today. I believe it is expected and just "noise". The alarm was triggered immediately after Exchange cleared the ThrottlingConfig.log. I know Exchange Server ...
0
votes
1answer
228 views

Blocking Email Attachment download from outside company in Office 365

In Office 365, Emails can accessed from anywhere (within or outside of the company). Want to block Email attachment download from outside of the company. Emails should be accessible from outside of ...
0
votes
0answers
824 views

Exchange Autodiscover XML question (Exploit related)

Recently we had an issue with the Exchange autodiscover.xml appending ".com" to our mail servers autodiscover address. It resulted in a certificate error due to the name not matching the certificate. ...
0
votes
0answers
84 views

What does it mean when a message's contentes are replaced by “Malware name: 'EngineError'” [duplicate]

Possible Duplicate: Does a blocked email with a malware name “EngineError” indicate a flaw in Forefront Protection? A privious post on this topic was closed as "unlikely to ever help ...