Disable OWA, but not ActiveSync 1

[snootalope]

Hello

We've got a group of users who all have smartphones that sync to our internal exchange 2003 sp2 server via activesync.

I've been asked to disable access to OWA from external locations, but do not disable the activesync feature. At first I thought this would be no problem, but now that I look at it closer I'm thinking otherwise.

Anyone know if this is possible? How one might accomplish this?

 

[zbnet]

ActiveSync and OWA both use the standard web ports, 80 and 443, so you can't easily allow one and restrict the other.

 

[Zelandakh]

You can do it on a per user basis in AD can't you?

 

[snootalope]

yeah.. you can disable the features per user in AD. I was just thinking since they're different virtual directories that maybe it was possible to restrict based on permissions maybe. But, OWA uses that \\.\backoffice directory that ya can't even get to.

 

[snootalope]

there's gotta be a way...

 

[Zelandakh]

The OWA directory is actually just an IIS link to the C:\Program Files\Exchsrvr\exchweb\bin\auth folder (or similar).

I've not tried but you could remove the directory security within IIS. Equally, when I say *could*, I realistically mean *don't do it*

 

[dbfphx]

Jumping in on an old thread, but...

I have just run across this problem myself. My fix was to change the Directory security IP restrictions to only allow internal addresses and loopback address (127.0.0.1) in the exchweb and exchange virtual folders.

So that is
IIS Mgmt console -
YourServer -
Websites -
DefaultWebSite -
exchweb (also do exchange)
(right click - properties)
Directory Security tab -
Edit IP Adress Restrictions
deny access except
127.0.0.1 (you need this for activesync)
any addresses or subnets you want

 

[cbride]

I used ADModify(

http://www.codeplex.com/admodify)

and turned off the access to Exchange HTTP for all the users but left the Outlook Mobile options in place and that seemed to do the trick as well.