Protect Exchange OWA from violence * * *

There are multiple vulnerabilities in the e-mail server, and in this article we will discuss how to protect Exchange OWA from violence * * *.

We know that the authentication of Exchange OWA is through active Directory. With active Directory, we can protect authentication. Even if users are locked in Active Directory, they can still access their e-mail messages. That is, the user is authenticated on OWA. This shows us the vulnerability of brute-force*** for Exchange OWA logins. Anyone can enter a random password at the same time without locking. So there's a problem with how we protect our OWA.

Solution:
Step 1: Maintain password policies from Active Directory domain controllers
To protect OWA from violence, we need to manage password policies on Active Directory.

PS C:\> Get-ADDefaultDomainPasswordPolicyComplexityEnabled           : TrueDistinguishedName           : DC=test,DC=localLockoutDuration             : 00:30:00LockoutObservationWindow    : 00:30:00LockoutThreshold            : 0MaxPasswordAge              : 42.00:00:00MinPasswordAge              : 1.00:00:00MinPasswordLength           : 7objectClass                 : {domainDNS}objectGuid                  : b373b1c1-28c2-497b-b388-654a408a69b3PasswordHistoryCount        : 24ReversibleEncryptionEnabled : False

To manage this policy, we only need to configure it from Group Policy.

Step 2: Configure Caching for IIS authentication
After you configure the password policy, the next step is to configure the cache for IIS authentication. As mentioned earlier, even if users are locked out on Active Directory, they can still access the OWA Portal. So to stop it, we need to reduce the caching of IIS Web sites. To reduce the cache, we need to do the following.

Open regedit on the Exchange CAS server.
Go to HKLM \ SYSTEM \ currentcontrolset \ Services \ InetInfo \ Parameters
Create a REG_DWORD named Usertokenttl and set a value of 30 (which means that the cache is only kept for 30 seconds).

Now, if the user enters the wrong password. Users will not be able to log on to their OWA or authenticate until the administrator unlocks the account.

Hopefully this will help you avoid violence.

Protect Exchange OWA from violence * * *