Scenario/Symptoms

If want to disable smart card authentication for Outlook anywhere for any business requirements or due to any problems encountered after enabling smart card authentication, you can use below to revert back the changes to disable smart card authentication for Outlook Anywhere in exchange server 2013.

Cause

Requirement / Misconfigurations/Corruptions

Resolution

Follow the instructions below to perform the task…

·         Copy the below script to a notepad file and save it as 'DisableOutlookSmartCardAuth.ps1' to '<Exchange install drive>:\Program Files\Microsoft\Exchange Server\V15\Scripts\'

·         Launch Exchange Management Shell and navigate to '<Exchange install drive>:\Program Files\Microsoft\Exchange Server\V15\Scripts\'

·         Run 'DisableOutlookSmartCardAuth.ps1'

·         Navigate to 'HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\RPC' and remove 'EnableSmartcard' - DWORD-32bit value

·         Delete and then recreate IIS Binding, also ensure a valid SSL certificate is selected (IIS --> Default Web Site --> Bindings… - 'https_ipport=0.0.0.0:443')

·         Reboot the Exchange Server.

Caution: Changes are made in IIS, application host configurations and registries… | (Backup Recommended)

Please see summary below to see what below script does.

Find the script below…

====================================================================================================

#Script Begins 

# Globals

$ComputerName = [string]$Env:computername

$setupRegistryPath = Get-ItemProperty -path 'HKLM:SOFTWARE\Microsoft\ExchangeServer\v15\Setup'

$exchangeInstallPath = $setupRegistryPath.MsiInstallPath 

$AutoDiscoverPath =  "Default Web Site/Autodiscover"

$EwsPath = "Default Web Site/EWS"

$EcpPath = "Default Web Site/ECP"

$OabPath = "Default Web Site/OAB"

$MapiPath = "Default Web Site/Mapi" 

# Initialize IIS metabase management object

$InitWebAdmin = [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.Web.Administration")

$Iis = new-object Microsoft.Web.Administration.ServerManager  

# Changes/removes a registry value under HKLM\Software\Microsoft\Rpc\RpcProxy to disable RpcWithCert

function DisableRpcWithCert

{

    $registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', '.')                

    $RpcProxyKey = $registry.OpenSubKey("Software\Microsoft\Rpc\RpcProxy", $true)

    $RpcProxyKey.SetValue("EnableRpcWithCert", 0)

    Write-Output "Registry updated, servicelet should disable RpcWithCert"

} 

# Updates path SSL Flags and disables the client-cert AD mapping

function DisableClientCertAuthForPath ([string]$IisPath)

{

    Write-Output "Disabling Require-Client-Certs + AD Cert Mapping for: $IisPath."

    $config = $Iis.GetApplicationHostConfiguration();   

    # Set SslFlags to require SSL and ignore client certificate

    $accessSection = $config.GetSection("system.webServer/security/access", $IisPath)

    $accessSection["sslFlags"] = "Ssl, Ssl128"   

    # Disable certificate-to-AD object mapping

    $clientCertificateMappingAuthenticationSection = $config.GetSection("system.webServer/security/authentication/clientCertificateMappingAuthentication", $IisPath)

    $clientCertificateMappingAuthenticationSection["enabled"] = $false

    $Iis.CommitChanges()

} 

# Updates path to disable client-cert AD mapping

function DisableAdClientCertAuthForPath([string]$IisPath)

{

    $config = $Iis.GetApplicationHostConfiguration();

    if ($IisPath -eq "")

    {

        Write-Output "Disabling AD Cert Mapping feature in IIS."

        $clientCertificateMappingAuthenticationSection = $config.GetSection("system.webServer/security/authentication/clientCertificateMappingAuthentication")

    }

    else

    {

        Write-Output "Disabling AD Cert Mapping for: $IisPath."

        $clientCertificateMappingAuthenticationSection = $config.GetSection("system.webServer/security/authentication/clientCertificateMappingAuthentication", $IisPath)

    } 

    $clientCertificateMappingAuthenticationSection["enabled"] = $false

    $Iis.CommitChanges()

} 

# Removes OAB auth module by updating web.config for OAB virtual directory

function UpdateOabWebConfig()

{

    if (Get-WebManagedModule -PSPath "iis:\sites\Default Web Site\OAB" -Name Microsoft.Exchange.OABAuth)

    {

Write-Output "OABAuthModule is present in OAB's web.config."

Begin-WebCommitDelay

Remove-WebManagedModule -PSPath "iis:\sites\Default Web Site\OAB" -Name "Microsoft.Exchange.OABAuth"

Write-Output "Removed OABAuthModule in OAB's web.config."

End-WebCommitDelay

    }

   } 

# Look for SslBinding's DefaultFlags and update as necessary

function FixSslDefaultFlags

{

    $registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', '.')                

            # Need to reset value to $HTTP_SERVICE_CONFIG_SSL_FLAG_USE_DS_MAPPER and then restart IIS and HTTP.SYS

            Write-Output "SChannel AD certificate mapping registry setting needs to be updated. Shutting down IIS and HTTP.SYS."

            iisreset /stop

            net stop http -force

            $defaultSslBinding = $registry.OpenSubKey("SYSTEM\\CurrentControlSet\\services\\HTTP\\Parameters\\SslBindingInfo\\0.0.0.0:443", $true)

            $defaultSslBinding.SetValue("defaultflags", 0)

            Write-Output "Registry updated, Restarting IIS and HTTP.SYS."

            iisreset /start

} 

# Look for valid port entries

function FixValidPorts

{   

    $registry = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', '.')                

    $rpcProxyKey = $registry.OpenSubKey("SOFTWARE\\Microsoft\\Rpc\\RpcProxy")   

    if ($rpcProxyKey -eq $Null)

    {

        # RPC/HTTP component is not correctly installed

        Write-Warning "RPC over HTTP Proxy feature is not correctly installed.  Please use Server Manager to reinstall this Windows Feature."

        break

    } 

    $validPorts = $rpcProxyKey.GetValue("Validports_Autoconfig_Exchange")    

    if ($validPorts -eq $null)

    {

        # enable-OutlookAnywhere was likely only recently enabled, add stub value and restart dependent services

        $rpcProxyKey = $registry.OpenSubKey("SOFTWARE\\Microsoft\\Rpc\\RpcProxy", $true)

        $rpcProxyKey.SetValue("Validports_Autoconfig_Exchange", "")  # set a stub value

        restart-service MSExchangeServiceHost

        restart-service MSExchangeFBA

    }

} 

# Main

Write-Output "Disables Smart Card Authentication for Outlook Anywhere"

Write-Output "Configuring authentication for Outlook Anywhere on $ComputerName..." "" 

# Test for Outlook Anywhere on current machine

if (Get-OutlookAnywhere -Server $ComputerName)

{

    Write-Output "Outlook Anywhere is configured on current machine."

    FixValidPorts

}

else

{

    Write-Warning "Enable-OutlookAnywhere must be run before configuring authentication.  Exiting."

    break

} 

# IIS: Disables server-wide Client certificate-to-AD authentication mapping

DisableAdClientCertAuthForPath ("")                                         # Global

DisableClientCertAuthForPath($AutoDiscoverPath)                 # AutoDiscover

DisableClientCertAuthForPath($EwsPath)                                 # EWS

DisableClientCertAuthForPath($EcpPath)                                 # ECP

DisableClientCertAuthForPath($OabPath)                                 # OAB

DisableClientCertAuthForPath($MapiPath)                                # Mapi 

# IIS: Outlook Anywhere: Disables Client certificate-to-AD authentication mapping

DisableRpcWithCert 

# Check on Schannel settings to ensure the DefaultFlags

FixSslDefaultFlags 

# Update OAB add web.config to add OABAuth module

UpdateOabWebConfig 

Write-Output "Done!  $ComputerName configured for default Outlook Anywhere and no longer configured with smart card/client certificate authentication"

$a=$Iis.Dispose() 

# End of Script. 

===================================================================================================

Summary

The above script (DisableOutlookSmartCardAuth.ps1) performs the following actions:

o Test if Outlook Anywhere is enabled on the current machine

o Disables server-wide Client certificate-to-AD authentication mapping from application host configurations

  · Set SSLFlags to require SSL and ignore client certificate ("system.webServer/security/access")  

  . Disables certificate-to-AD object mapping ("system.webServer/security/authentication/clientCertificateMappingAuthentication")

o Disables ‘RPC with Cert’ to use /RPC virtual directory

   . Modifies/removes a DWORD 32-bit registry value 'EnableRpcWithCert' under 'HKLM\Software\Microsoft\Rpc\RpcProxy'

o Look for SSL binding's default flags and update as required

   · Modifies a DWORD 32-bit registry value 'defaultflags' under 'HKLM\CCS\services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443'

o Removes 'Microsoft.Exchange.OABAuth' module by updating 'web.config' for /OAB virtual directory

o Performs 'iisreset'

More Information

Configure Smart Card Authentication for Outlook Anywhere in Exchange 2013

https://technet.microsoft.com/en-us/library/dn960152(v=exchg.150).aspx 

Scripting with the Exchange Management Shell

https://technet.microsoft.com/en-us/library/bb123798.aspx

Query Words

smart card authentication, rpcwithcert, client certificate authentication, outlook anywhere, exchange server 2013

Special thanks to Pradeep Bachrani who worked on this issue till resolution and prepared Draft for this Blog.

Symptom

On domain-joined computers, there were limited number of Fonts visible under Font drop down while drafting a new email in OWA as per the below Screenshot:-

It was found working on the Exchange Server itself and also on the Non-Domain joined machines.

We then added one client computer in the newly created OU for testing purpose which didn’t have any Group Policy being applied and noticed that all fonts were visible as expected.

It meant there was some Group policy being applied on clients causing the issue.

In order to identify the affected Group policy being applied, we collected Group policy result using following command : 

GPRESULT /H client_gp.htm

Applied Group Policy Objects:

IE 11

Office Windows 8

We disabled Policies one by one and found that Group Policy IE11 was the culprit.

Post further digging around Group Policy IE11, we found the below suspected GPO Setting

Under Group Policy when we browse through Windows Component =>Internet Explorer => Security Features => Add-on Management , we have the following configured settings.

In "Add-on List", there were many Class IDs visible and setting was set to be enabled.

However "Deny All Add-on unless specifically allowed in the Add-on list" was denying all the add-ons which are not added explicitly in "Add-on List". To identify which Add-on was not there in allowed "Add-on List" we did following Lab testing.

Labwork :

We tested following on non-domain joined (workgroup) machine : 

In Internet Explorer Settings > Manage Add-ons, we disable all Add-ons and then enable all Add-ons one by one and observe the behavior. Post disabling all Add-ons issue was reproducible untill we enabled one of the add-on named as "HtmlDlgSafeHelper Class". Upon enabling "HtmlDlgSafeHelper Class" Add-on we are able to see all the fonts in OWA.

Solution

There are Two possible solutions :

1. Disable Deny All Add-on unless specifically allowed in the Add-on list Gpo setting

2. Explicitly Add "HtmlDlgSafeHelper Class" CLSID in allowed Add-on List

Customer accepted 2nd  solution in our case.

This was really an interesting case as each and every section got unfolded with interesting facts which made us reach to resolution.

Note:-

What is HtmlDlgSafeHelper (Dialog Helper) object-> It Provides access to the color dialog box, block formats, and system fonts collections.

Refer

HtmlDlgSafeHelper (Dialog Helper) object

https://msdn.microsoft.com/en-us/library/ms535238(v=vs.85).aspx

How to Disable Internet Explorer (IE) Add-Ons through Group Policy

https://social.technet.microsoft.com/wiki/contents/articles/11406.how-to-disable-internet-explorer-ie-add-ons-through-group-policy.aspx

Enable and disable add-ons using administrative templates and group policy

https://msdn.microsoft.com/en-us/library/dn454941.aspx 

Environment:- >Exchange 2013 Cu4, different Active sync devices in place.

In outlook and OWA we were able to see these Folder's/subfolder's fine.

This issue started post migration from 3rd party Messaging solution to Exchange 2013.

During the course of Troubleshooting , ActiveSync virtual Directory was recreated for testing purpose,

We then removed the Active Sync devices for one of the Mailbox through Mfcmapi, set Activesyncmailbox logging to true,  and then reconfigured Active Sync Profile and reproduced the issue.

Exchange ActiveSync Mailbox Logging enabled by running the below command:->

Set-CASMailbox -Identity "Test" -ActiveSyncDebugLogging:$True

Test-ActiveSyncConnectivity and Exchange remote connectivity analyzer result passed successfully .

We took note of the exact time when we triggered Sync process by creating Active Sync device Profile and we notice that

Client sending the FolderSync command with the folderhierarchy:SyncKey  and  server responding with the folder hierarchy.

Still same issue noticed ( Folders not getting Synced in Active Sync devices even though those folders were visible in OWA/Outlook).

Step for removing ActiveSync device partnership using Mfcmapi->

I. Set up a profile in Outlook for “user” - profile must be in online mode and not in cached mode
II. Start MFCMapi
III. Menu Session > Logon [choose the correct Outlook Profile]
IV. Double click the "Mailbox - User1"
V. Expand the "Root Container"
VI. Expand the "ExchangeSyncData"
VII. Remove every device (a folder named AirSync-* under ExchangeSyncData in a device)
VIII. Logoff from the mailbox
IX. Close MFCMapi

We then eventually took Mfcmapi Dump of the working and non working Folders and that's when we got the crucial Breakthrough.

• Message property PR_CONTAINER_CLASS for Non Working folder was IPF.Imap.
• Message property PR_CONTAINER_CLASS for Working folder was  IPF.Note.

Exchange does not recognize IPF.Imap as a IPM format.

We changed the PR_CONTAINER_CLASS using Mfcmapi from IPF.Imap to IPF.Note for the affected Folders and recreated Profile. Folder's then got synced fine.

Conclusion:->

Some how while migration from 3rd party Messaging solution to Exchange, Folder property PR_CONTAINER_CLASS might have got changed to  IPF.IMAP whereas it should be set as IPF.Note Format.

References :

3.1.5.3 Synchronizing a Folder Hierarchy

Test-ActiveSyncConnectivity

Microsoft Remote Connectivity Analyzer

Exchange ActiveSync Mailbox Logging

Don’t worry here is a blog which explains this.

What Authentication Capabilities are available with IMAP depends upon what you have set in IMAP settings.

For this demo I have set  EnableGSSAPIAndNTLMAuth to True using the below method:-

Open Exchange Management Shell on Microsoft Exchange Server 2010 that has the Client Access Server role.

Set-ImapSettings -Server FAB-DAL-E10A.Fabrikam.com  -LoginType 2 -EnableGSSAPIAndNTLMAuth $True

Restart Microsoft Exchange IMAP4 service.

To know what Authentication Mechanisms are available on IMAP, we will have to follow the steps given below :

Open Command Prompt and telnet imap on port 143

Telnet FAB-DAL-E10A.Fabrikam.com  143

* OK The Microsoft Exchange IMAP4 service is ready.

* capability

* CAPABILITY IMAP4 IMAP4rev1 AUTH=NTLM AUTH=GSSAPI LOGINDISABLED STARTTLS CHILDREN IDLE NAMESPACE LITERAL+

* OK CAPABILITY completed.

For information about Managing IMAP4 please go through following article.

View or Configure IMAP4 Properties