External Exchange Web Service configuration

Question

We are using Exchange 2016 with Hybrid setup. Eventually we have suspect some brute force account attack on our On-Perm Exchange web service, which makes account lock frequently.

We have tried ews, activesync and autodiscover web service may face this login attempt.

Does any one got idea how to avoid this situation?

Answer 1

Hi @Tang, Ken,

Welcome to the Microsoft Q&A platform!

Based on your description, you are dealing with a situation where the On-Perm Exchange network service has been hit by some brute force account attacks. Here are some strategies to help mitigate brute force attacks against your Exchange 2016 Hybrid setup:

1. Adding an extra layer of security can significantly reduce the risk of unauthorized access.
2. Limit access to Exchange services via VPN. This ensures that only users connected to the internal network can access the services.
3. Configure your Active Directory to lock accounts after a certain number of failed login attempts. This helps prevent brute force attacks.
4. Adding reCAPTCHA to your OWA/ECP login page can help block automated login attempts.
5. Implement authentication policies to detect and block password spray attacks, which are a type of brute force attack.
6. Regularly monitor your logs for suspicious activity and block IP addresses that show signs of brute force attempts.

---

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang