Share via

Exchange Server 2013: Disable Smart Card Authentication for Outlook Anywhere

  • Article

If you have enabled smart card authentication for Outlook Anywhere and would like to disable same for any business requirements or due to any problems encountered after enabling smart card authentication, you can use below to revert back the changes to disable smart card authentication for Outlook Anywhere in exchange server 2013.

Causes:

  • Requirement
  • Misconfigurations
  • Corruptions

Resolution:

Follow the instructions below to perform the task - AYOR...

  • Copy the below script to a notepad file and save it as ‘DisableOutlookSmartCardAuth.ps1’ to ‘<Exchange install drive>:\Program Files\Microsoft\Exchange Server\V15\Scripts\
  • Launch Exchange Management Shell and navigate to ‘<Exchange install drive>:\Program Files\Microsoft\Exchange Server\V15\Scripts\
  • Run ‘DisableOutlookSmartCardAuth.ps1’
  • Navigate to ‘HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\RPC’ and remove ‘EnableSmartcard’ – DWORD-32bit value
  • Delete and then recreate IIS Binding, also ensure a valid SSL certificate is selected (IIS –> Default Web Site –> Bindings… – ‘https_ipport=0.0.0.0:443’)
  • Reboot the Exchange Server.

Caution: Changes are made in IIS, application host configurations and registries… | (Backup Recommended)

Powershell Script

Find the script below…

Download Script

001















002















003















004















005















006















007















008















009















010















011















012















013















014















015















016















017















018















019















020















021















022















023















024















025















026















027















028















029















030















031















032















033















034















035















036















037















038















039















040















041















042















043















044















045















046















047















048















049















050















051















052















053















054















055















056















057















058















059















060















061















062















063















064















065















066















067















068















069















070















071















072















073















074















075















076















077















078















079















080















081















082















083















084















085















086















087















088















089















090















091















092















093















094















095















096















097















098















099















100















101















102















103















104















105















106















107















108















109















110















111















112















113















114















115















116















117















118















119















120















121















122















123















124















125















126















127















128















 #Script Begins 















# Globals















$ComputerName = [string]$Env:computername















$setupRegistryPath = Get-ItemProperty -path  HKLM:SOFTWARE\Microsoft\ExchangeServer\v15\Setup















$exchangeInstallPath = $setupRegistryPath.MsiInstallPath 















$AutoDiscoverPath =   Default Web Site/Autodiscover















$EwsPath =  Default Web Site/EWS















$EcpPath =  Default Web Site/ECP















$OabPath =  Default Web Site/OAB















$MapiPath =  Default Web Site/Mapi  















# Initialize IIS metabase management object















$InitWebAdmin = [System.Reflection.Assembly]::LoadWithPartialName( Microsoft.Web.Administration )















$Iis = new-object Microsoft.Web.Administration.ServerManager  















# Changes/removes a registry value under HKLM\Software\Microsoft\Rpc\RpcProxy tdisable RpcWithCert















function DisableRpcWithCert















{















   $registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey( LocalMachine ,  . )                















   $RpcProxyKey = $registry.OpenSubKey( Software\Microsoft\Rpc\RpcProxy , $true)















   $RpcProxyKey.SetValue( EnableRpcWithCert , 0)















   Write-Output  Registry updated, servicelet should disable RpcWithCert















} 















# Updates path SSL Flags and disables the client-cert AD mapping















function DisableClientCertAuthForPath ([string]$IisPath)















{















   Write-Output  Disabling Require-Client-Certs + AD Cert Mapping for: $IisPath.















   $config = $Iis.GetApplicationHostConfiguration();  















   # Set SslFlags trequire SSL and ignore client certificate















   $accessSection = $config.GetSection( system.webServer/security/access , $IisPath)















   $accessSection[ sslFlags ] =  Ssl, Ssl128   















# Disable certificate-to-AD object mapping















    $clientCertificateMappingAuthenticationSection =  $config.GetSection( system.webServer/security/authentication/clientCertificateMappingAuthentication , $IisPath)















    $clientCertificateMappingAuthenticationSection[ enabled ] = $false















    $Iis.CommitChanges()















} 















# Updates path tdisable client-cert AD mapping















function DisableAdClientCertAuthForPath([string]$IisPath)















{















   $config = $Iis.GetApplicationHostConfiguration();















   if ($IisPath -eq  )















   {















       Write-Output  Disabling AD Cert Mapping feature in IIS.















       $clientCertificateMappingAuthenticationSection =















$config.GetSection( system.webServer/security/authentication/clientCertificateMappingAuthentication )















   }















   else















   {















       Write-Output  Disabling AD Cert Mapping for: $IisPath.















       $clientCertificateMappingAuthenticationSection = $config.GetSection( system.webServer/security/authentication/clientCertificateMappingAuthentication , $IisPath)















   } 















   $clientCertificateMappingAuthenticationSection[ enabled ] = $false















   $Iis.CommitChanges()















} 















# Removes OAB auth module by updating web.config for OAB virtual directory















function UpdateOabWebConfig()















{















   if (Get-WebManagedModule -PSPath  iis:\sites\Default Web Site\OAB  -Name Microsoft.Exchange.OABAuth)















   {















Write-Output  OABAuthModule is present in OAB s web.config.















Begin-WebCommitDelay















Remove-WebManagedModule -PSPath  iis:\sites\Default Web Site\OAB  -Name  Microsoft.Exchange.OABAuth















Write-Output  Removed OABAuthModule in OAB s web.config.















End-WebCommitDelay















   }















 } 















# Look for SslBinding s DefaultFlags and update as necessary















function FixSslDefaultFlags















{















   $registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey( LocalMachine ,  . )                















           # Need treset value t$HTTP_SERVICE_CONFIG_SSL_FLAG_USE_DS_MAPPER and then restart IIS and HTTP.SYS















           Write-Output  SChannel AD certificate mapping registry setting needs tbe updated. Shutting down IIS and HTTP.SYS.















           iisreset /stop















           net stop http -force















           $defaultSslBinding = $registry.OpenSubKey( SYSTEM\\CurrentControlSet\\services\\HTTP\\Parameters\\SslBindingInfo\\0.0.0.0:443 , $true)















           $defaultSslBinding.SetValue( defaultflags , 0)















           Write-Output  Registry updated, Restarting IIS and HTTP.SYS.















           iisreset /start















} 















# Look for valid port entries















function FixValidPorts















{  















   $registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey( LocalMachine ,  . )                















   $rpcProxyKey = $registry.OpenSubKey( SOFTWARE\\Microsoft\\Rpc\\RpcProxy )  















   if ($rpcProxyKey -eq $Null)















   {















       # RPC/HTTP component is not correctly installed















       Write-Warning  RPC over HTTP Proxy feature is not correctly installed.  Please use Server Manager treinstall this Windows Feature.















       break















   } 















   $validPorts = $rpcProxyKey.GetValue( Validports_Autoconfig_Exchange )    















   if ($validPorts -eq $null)   















{















       # enable-OutlookAnywhere was likely only recently enabled, add stub value and restart dependent services















       $rpcProxyKey = $registry.OpenSubKey( SOFTWARE\\Microsoft\\Rpc\\RpcProxy , $true)















       $rpcProxyKey.SetValue( Validports_Autoconfig_Exchange ,  )  # set a stub value















       restart-service MSExchangeServiceHost















       restart-service MSExchangeFBA















   }















} 















# Main















Write-Output  Disables Smart Card Authentication for Outlook Anywhere















Write-Output  Configuring authentication for Outlook Anywhere on $ComputerName    















# Test for Outlook Anywhere on current machine















if (Get-OutlookAnywhere -Server $ComputerName)















{















   Write-Output  Outlook Anywhere is configured on current machine.















   FixValidPorts















}















else















{















   Write-Warning  Enable-OutlookAnywhere must be run before configuring authentication.  Exiting.















   break















} 















# IIS: Disables server-wide Client certificate-to-AD authentication mapping















DisableAdClientCertAuthForPath ( )  # Global















DisableClientCertAuthForPath($AutoDiscoverPath)  # AutoDiscover















DisableClientCertAuthForPath($EwsPath)  # EWS















DisableClientCertAuthForPath($EcpPath)  # ECP















DisableClientCertAuthForPath($OabPath)  # OAB















DisableClientCertAuthForPath($MapiPath) # Mapi 















# IIS: Outlook Anywhere: Disables Client certificate-to-AD authentication mapping















DisableRpcWithCert 















# Check on Schannel settings tensure the DefaultFlagsFixSslDefaultFlags 















# Update OAB add web.config tadd OABAuth module















UpdateOabWebConfig 















Write-Output  Done!  $ComputerName configured for default Outlook Anywhere and nlonger configured with smart card/client certificate authentication















$a=$Iis.Dispose() 















# End of Script

 

Summary

The above script (DisableOutlookSmartCardAuth.ps1) performs the following actions:

  • Test if Outlook Anywhere is enabled on the current machine
  • Disables server-wide Client certificate-to-AD authentication mapping from application host configurations
    • Set SSLFlags to require SSL and ignore client certificate (“system.webServer/security/access”) 
    •  Disables certificate-to-AD object mapping (“system.webServer/security/authentication/clientCertificateMappingAuthentication”)
  • Disables ‘RPC with Cert’ to use /RPC virtual directory
    • Modifies/removes a DWORD 32-bit registry value ‘EnableRpcWithCert’ under ‘HKLM\Software\Microsoft\Rpc\RpcProxy’
  • Look for SSL binding’s default flags and update as required
    • Modifies a DWORD 32-bit registry value ‘defaultflags’ under ‘HKLM\CCS\services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443’
  • o Removes ‘Microsoft.Exchange.OABAuth’ module by updating ‘web.config’ for /OAB virtual directory
  • Performs ‘iisreset’

More Information