Partager via

Disable Smart Card Authentication for Outlook Anywhere - Exchange 2013

  • Article

Special Thanks to Krishna Kumar Thirumalai Nambi who worked on this issue and prepared Draft for this blog.

Scenario/Symptoms

If want to disable smart card authentication for Outlook anywhere for any business requirements or due to any problems encountered after enabling smart card authentication, you can use below to revert back the changes to disable smart card authentication for Outlook Anywhere in exchange server 2013.

Cause

Requirement / Misconfigurations/Corruptions

Resolution

 

Follow the instructions below to perform the task…

·         Copy the below script to a notepad file and save it as 'DisableOutlookSmartCardAuth.ps1' to '<Exchange install drive>:\Program Files\Microsoft\Exchange Server\V15\Scripts\'

·         Launch Exchange Management Shell and navigate to '<Exchange install drive>:\Program Files\Microsoft\Exchange Server\V15\Scripts\'

·         Run 'DisableOutlookSmartCardAuth.ps1'

·         Navigate to 'HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\RPC' and remove 'EnableSmartcard' - DWORD-32bit value

·         Delete and then recreate IIS Binding, also ensure a valid SSL certificate is selected (IIS --> Default Web Site --> Bindings… - 'https_ipport=0.0.0.0:443')

·         Reboot the Exchange Server.

Caution: Changes are made in IIS, application host configurations and registries… | (Backup Recommended)

Please see summary below to see what below script does.

Find the script below…

====================================================================================================

#Script Begins 

# Globals

$ComputerName = [string]$Env:computername

$setupRegistryPath = Get-ItemProperty -path 'HKLM:SOFTWARE\Microsoft\ExchangeServer\v15\Setup'

$exchangeInstallPath = $setupRegistryPath.MsiInstallPath 

$AutoDiscoverPath =  "Default Web Site/Autodiscover"

$EwsPath = "Default Web Site/EWS"

$EcpPath = "Default Web Site/ECP"

$OabPath = "Default Web Site/OAB"

$MapiPath = "Default Web Site/Mapi" 

# Initialize IIS metabase management object

$InitWebAdmin = [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.Web.Administration")

$Iis = new-object Microsoft.Web.Administration.ServerManager  

# Changes/removes a registry value under HKLM\Software\Microsoft\Rpc\RpcProxy to disable RpcWithCert

function DisableRpcWithCert

{

    $registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', '.')                

    $RpcProxyKey = $registry.OpenSubKey("Software\Microsoft\Rpc\RpcProxy", $true)

    $RpcProxyKey.SetValue("EnableRpcWithCert", 0)

    Write-Output "Registry updated, servicelet should disable RpcWithCert"

} 

# Updates path SSL Flags and disables the client-cert AD mapping

function DisableClientCertAuthForPath ([string]$IisPath)

{

    Write-Output "Disabling Require-Client-Certs + AD Cert Mapping for: $IisPath."

    $config = $Iis.GetApplicationHostConfiguration();   

    # Set SslFlags to require SSL and ignore client certificate

    $accessSection = $config.GetSection("system.webServer/security/access", $IisPath)

    $accessSection["sslFlags"] = "Ssl, Ssl128"   

    # Disable certificate-to-AD object mapping

    $clientCertificateMappingAuthenticationSection = $config.GetSection("system.webServer/security/authentication/clientCertificateMappingAuthentication", $IisPath)

    $clientCertificateMappingAuthenticationSection["enabled"] = $false

    $Iis.CommitChanges()

} 

# Updates path to disable client-cert AD mapping

function DisableAdClientCertAuthForPath([string]$IisPath)

{

    $config = $Iis.GetApplicationHostConfiguration();

    if ($IisPath -eq "")

    {

        Write-Output "Disabling AD Cert Mapping feature in IIS."

        $clientCertificateMappingAuthenticationSection = $config.GetSection("system.webServer/security/authentication/clientCertificateMappingAuthentication")

    }

    else

    {

        Write-Output "Disabling AD Cert Mapping for: $IisPath."

        $clientCertificateMappingAuthenticationSection = $config.GetSection("system.webServer/security/authentication/clientCertificateMappingAuthentication", $IisPath)

    } 

    $clientCertificateMappingAuthenticationSection["enabled"] = $false

    $Iis.CommitChanges()

} 

# Removes OAB auth module by updating web.config for OAB virtual directory

function UpdateOabWebConfig()

{

    if (Get-WebManagedModule -PSPath "iis:\sites\Default Web Site\OAB" -Name Microsoft.Exchange.OABAuth)

    {

Write-Output "OABAuthModule is present in OAB's web.config."

Begin-WebCommitDelay

Remove-WebManagedModule -PSPath "iis:\sites\Default Web Site\OAB" -Name "Microsoft.Exchange.OABAuth"

Write-Output "Removed OABAuthModule in OAB's web.config."

End-WebCommitDelay

    }

   } 

# Look for SslBinding's DefaultFlags and update as necessary

function FixSslDefaultFlags

{

    $registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', '.')                

            # Need to reset value to $HTTP_SERVICE_CONFIG_SSL_FLAG_USE_DS_MAPPER and then restart IIS and HTTP.SYS

            Write-Output "SChannel AD certificate mapping registry setting needs to be updated. Shutting down IIS and HTTP.SYS."

            iisreset /stop

            net stop http -force

            $defaultSslBinding = $registry.OpenSubKey("SYSTEM\\CurrentControlSet\\services\\HTTP\\Parameters\\SslBindingInfo\\0.0.0.0:443", $true)

            $defaultSslBinding.SetValue("defaultflags", 0)

            Write-Output "Registry updated, Restarting IIS and HTTP.SYS."

            iisreset /start

} 

# Look for valid port entries

function FixValidPorts

{   

    $registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', '.')                

    $rpcProxyKey = $registry.OpenSubKey("SOFTWARE\\Microsoft\\Rpc\\RpcProxy")   

    if ($rpcProxyKey -eq $Null)

    {

        # RPC/HTTP component is not correctly installed

        Write-Warning "RPC over HTTP Proxy feature is not correctly installed.  Please use Server Manager to reinstall this Windows Feature."

        break

    } 

    $validPorts = $rpcProxyKey.GetValue("Validports_Autoconfig_Exchange")    

    if ($validPorts -eq $null)

    {

        # enable-OutlookAnywhere was likely only recently enabled, add stub value and restart dependent services

        $rpcProxyKey = $registry.OpenSubKey("SOFTWARE\\Microsoft\\Rpc\\RpcProxy", $true)

        $rpcProxyKey.SetValue("Validports_Autoconfig_Exchange", "")  # set a stub value

        restart-service MSExchangeServiceHost

        restart-service MSExchangeFBA

    }

} 

# Main

Write-Output "Disables Smart Card Authentication for Outlook Anywhere"

Write-Output "Configuring authentication for Outlook Anywhere on $ComputerName..." "" 

# Test for Outlook Anywhere on current machine

if (Get-OutlookAnywhere -Server $ComputerName)

{

    Write-Output "Outlook Anywhere is configured on current machine."

    FixValidPorts

}

else

{

    Write-Warning "Enable-OutlookAnywhere must be run before configuring authentication.  Exiting."

    break

} 

# IIS: Disables server-wide Client certificate-to-AD authentication mapping

DisableAdClientCertAuthForPath ("")                                         # Global

DisableClientCertAuthForPath($AutoDiscoverPath)                 # AutoDiscover

DisableClientCertAuthForPath($EwsPath)                                 # EWS

DisableClientCertAuthForPath($EcpPath)                                 # ECP

DisableClientCertAuthForPath($OabPath)                                 # OAB

DisableClientCertAuthForPath($MapiPath)                                # Mapi 

# IIS: Outlook Anywhere: Disables Client certificate-to-AD authentication mapping

DisableRpcWithCert 

# Check on Schannel settings to ensure the DefaultFlags

FixSslDefaultFlags 

# Update OAB add web.config to add OABAuth module

UpdateOabWebConfig 

Write-Output "Done!  $ComputerName configured for default Outlook Anywhere and no longer configured with smart card/client certificate authentication"

$a=$Iis.Dispose() 

# End of Script. 

===================================================================================================

Summary

 

The above script (DisableOutlookSmartCardAuth.ps1) performs the following actions:

o Test if Outlook Anywhere is enabled on the current machine

o Disables server-wide Client certificate-to-AD authentication mapping from application host configurations

  · Set SSLFlags to require SSL and ignore client certificate ("system.webServer/security/access")  

  . Disables certificate-to-AD object mapping ("system.webServer/security/authentication/clientCertificateMappingAuthentication")

o Disables ‘RPC with Cert’ to use /RPC virtual directory

   . Modifies/removes a DWORD 32-bit registry value 'EnableRpcWithCert' under 'HKLM\Software\Microsoft\Rpc\RpcProxy'

o Look for SSL binding's default flags and update as required

   · Modifies a DWORD 32-bit registry value 'defaultflags' under 'HKLM\CCS\services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443'

o Removes 'Microsoft.Exchange.OABAuth' module by updating 'web.config' for /OAB virtual directory

o Performs 'iisreset'

More Information

Configure Smart Card Authentication for Outlook Anywhere in Exchange 2013

https://technet.microsoft.com/en-us/library/dn960152(v=exchg.150).aspx 

Scripting with the Exchange Management Shell

https://technet.microsoft.com/en-us/library/bb123798.aspx

Query Words

smart card authentication, rpcwithcert, client certificate authentication, outlook anywhere, exchange server 2013